@@ -1550,6 +1550,35 @@ def execute(self):
         )
 
 
+class BreakpointOnUnreachableTestCase:
+    test_file = "resources/wasm/unreachable.js"
+
+    def execute(self):
+        # A breakpoint on unreachable reports the breakpoint first, then the trap.
+        self.session.cmd("b 0x4000000000000024", patterns=["Breakpoint 1"])
+        self.session.cmd(
+            "c",
+            patterns=["Process 1 stopped", "stop reason = breakpoint 1", "->  0x4000000000000024: unreachable"],
+        )
+        self.session.cmd(
+            "c",
+            patterns=["Process 1 stopped", "Unreachable code should not be executed"],
+        )
+
+
+class StepOffUnreachableTestCase:
+    test_file = "resources/wasm/unreachable.js"
+
+    def execute(self):
+        # Unreachable has no successor instruction, so a step off it lands on the trap.
+        self.session.cmd("b 0x4000000000000024", patterns=["Breakpoint 1"])
+        self.session.cmd(
+            "c",
+            patterns=["Process 1 stopped", "stop reason = breakpoint 1", "->  0x4000000000000024: unreachable"],
+        )
+        self.session.cmd("si", patterns=["Unreachable code should not be executed"])
+
+
 class WasmDivByZeroTrapTestCase:
     test_file = "resources/wasm/trap-div-by-zero.js"
 
@@ -1756,6 +1785,8 @@ def execute(self):
     WasmJsWasmJsWasmCallStackTestCase,
     SwiftWasmCrashTestCase,
     WasmUnreachableFaultTestCase,
+    BreakpointOnUnreachableTestCase,
+    StepOffUnreachableTestCase,
     WasmDivByZeroTrapTestCase,
     WasmOutOfBoundsCallIndirectTrapTestCase,
     WasmStackOverflowTrapTestCase,
 
@@ -1162,14 +1162,11 @@ end
 
 op(wasm_ipint_check_debugger_hook_and_throw_trap, macro ()
     handleDebuggerTrapIfNeeded()
-    # r0 == 0 i.e. DebuggerTrapStatus::ResolvedByDebugger i.e. this was purely a debugger trap / breakpoint,
-    #              and has been handled.  We should continue executing because it's not a Wasm trap.
-    # r0 == 1 i.e. DebuggerTrapStatus::NotResolvedByDebugger i.e. this was a fatal Wasm trap.  We should
-    #              throw it to terminate Wasm execution.
-    btpz r0, .continue
+    # r0 is the displaced opcode to resume with, or Unreachable (0) to throw.
+    btpz r0, .throwTrap
+    dispatchIPIntOpcode(r0)
+.throwTrap:
     jmp _wasm_throw_from_slow_path_trampoline
-.continue:
-    nextIPIntInstruction()
 end)
 
 op(wasm_throw_from_slow_path_trampoline, macro ()
 
@@ -64,23 +64,26 @@ end
 
 # Tail-call bytecode dispatch
 
-macro nextIPIntInstruction()
-    loadb [PC], t0
+macro dispatchIPIntOpcode(opcode)
 if ARM64 or ARM64E
-    # x0 = opcode
     pcrtoaddr ipint_dispatch_base, t7
-    addlshiftp t7, t0, (constexpr (WTF::fastLog2(JSC::IPInt::alignIPInt))), t0
+    addlshiftp t7, opcode, (constexpr (WTF::fastLog2(JSC::IPInt::alignIPInt))), t0
     jmp t0
 elsif X86_64
     pcrtoaddr ipint_dispatch_base, t1
-    lshiftq (constexpr (WTF::fastLog2(JSC::IPInt::alignIPInt))), t0
-    addq t1, t0
-    jmp t0
+    lshiftq (constexpr (WTF::fastLog2(JSC::IPInt::alignIPInt))), opcode
+    addq t1, opcode
+    jmp opcode
 else
     error
 end
 end
 
+macro nextIPIntInstruction()
+    loadb [PC], t0
+    dispatchIPIntOpcode(t0)
+end
+
 # Stack operations
 # Every value on the stack is always 16 bytes! This makes life easy.
 
 
@@ -1506,10 +1506,8 @@ static UNUSED_FUNCTION void displayWasmDebugState(JSWebAssemblyInstance* instanc
 
 WASM_IPINT_EXTERN_CPP_DECL(handle_debugger_trap_if_needed, CallFrame* callFrame, Register* sp)
 {
-    // By default, the trap is a fatal Wasm trap and must propagate (shouldThrow = true).
-    // If the debugger is connected and determines this was solely a debugger trap (e.g. a
-    // breakpoint on unreachable), it sets shouldThrow = false and execution resumes.
-    bool shouldThrow = true;
+    // Unreachable propagates the trap; otherwise resumes with the displaced opcode.
+    Wasm::OpType resumeOpcode = Wasm::OpType::Unreachable;
 #if ENABLE(WEBASSEMBLY_DEBUGGER)
     if (Options::enableWasmDebugger()) [[unlikely]] {
         Wasm::DebugServer& debugServer = Wasm::DebugServer::singleton();
@@ -1521,16 +1519,15 @@ WASM_IPINT_EXTERN_CPP_DECL(handle_debugger_trap_if_needed, CallFrame* callFrame,
             auto exceptionType = static_cast<Wasm::ExceptionType>(callFrame->argumentCountIncludingThis());
             if (Options::verboseWasmDebugger() && exceptionType == Wasm::ExceptionType::Unreachable)
                 displayWasmDebugState(instance, callee, callFrame, stack);
-            auto trapStatus = debugServer.execution().handleDebuggerTrapIfNeeded(callFrame, instance, callee, pc, mc, stack, exceptionType);
-            shouldThrow = trapStatus == Wasm::DebuggerTrapStatus::NotResolvedByDebugger;
+            resumeOpcode = debugServer.execution().handleDebuggerTrapIfNeeded(callFrame, instance, callee, pc, mc, stack, exceptionType);
         }
     }
 #else
     UNUSED_PARAM(instance);
     UNUSED_PARAM(callFrame);
     UNUSED_PARAM(sp);
 #endif
-    IPINT_RETURN(static_cast<EncodedJSValue>(static_cast<int32_t>(shouldThrow)));
+    IPINT_RETURN(static_cast<EncodedJSValue>(static_cast<uint32_t>(resumeOpcode)));
 }
 
 } } // namespace JSC::IPInt
 
@@ -44,58 +44,90 @@ BreakpointManager::~BreakpointManager()
     clearAllBreakpoints();
 }
 
-bool BreakpointManager::hasBreakpoints()
+bool BreakpointManager::hasOneTimeBreakpoints()
 {
     Locker locker { m_lock };
-    return !m_breakpoints.isEmpty();
+    return !m_oneTimeBreakpoints.isEmpty();
 }
 
-bool BreakpointManager::hasOneTimeBreakpoints()
+Breakpoint& BreakpointManager::ensurePatched(const ModuleInformation& owner, uint8_t* pc)
 {
-    Locker locker { m_lock };
-    return !m_oneTimeBreakpoints.isEmpty();
+    RELEASE_ASSERT(pc);
+    if (auto it = m_breakpoints.find(pc); it != m_breakpoints.end()) {
+        dataLogLnIf(Options::verboseWasmDebugger(), "[BreakpointManager] Reusing the patch at ", RawPointer(pc));
+        return it->value;
+    }
+
+    Ref<Breakpoint> breakpoint = Breakpoint::create(owner, pc);
+    breakpoint->patchBreakpoint();
+    dataLogLnIf(Options::verboseWasmDebugger(), "[BreakpointManager] Patched ", breakpoint);
+    return m_breakpoints.set(pc, WTF::move(breakpoint)).iterator->value;
 }
 
-void BreakpointManager::setBreakpoint(VirtualAddress address, Ref<Breakpoint>&& breakpoint)
+void BreakpointManager::releasePatchIfUnused(uint8_t* pc)
+{
+    auto it = m_breakpoints.find(pc);
+    RELEASE_ASSERT(it != m_breakpoints.end());
+    if (it->value->hasSite || m_oneTimeBreakpoints.contains(pc))
+        return;
+
+    dataLogLnIf(Options::verboseWasmDebugger(), "[BreakpointManager] Restoring ", it->value);
+    it->value->restorePatch();
+    m_breakpoints.remove(it);
+}
+
+void BreakpointManager::setStepBreakpoint(const ModuleInformation& owner, uint8_t* pc)
 {
     Locker locker { m_lock };
-    breakpoint->patchBreakpoint();
-    dataLogLnIf(Options::verboseWasmDebugger(), "[BreakpointManager] setBreakpoint ", breakpoint, " at moduleAddress:", address);
-    if (breakpoint->isOneTimeBreakpoint())
-        m_oneTimeBreakpoints.add(address);
-    m_breakpoints.set(address, WTF::move(breakpoint));
+    ensurePatched(owner, pc);
+    m_oneTimeBreakpoints.add(pc);
 }
 
-RefPtr<Breakpoint> BreakpointManager::findBreakpoint(VirtualAddress address)
+void BreakpointManager::setBreakpointAt(VirtualAddress address, const ModuleInformation& owner, uint8_t* pc)
 {
     Locker locker { m_lock };
-    return m_breakpoints.get(address);
+    // Re-arming an existing site is a no-op.
+    auto result = m_addressToPC.add(address, pc);
+    if (!result.isNewEntry) {
+        RELEASE_ASSERT(result.iterator->value == pc);
+        return;
+    }
+    ensurePatched(owner, pc).hasSite = true;
 }
 
-bool BreakpointManager::removeBreakpointImpl(VirtualAddress address)
+bool BreakpointManager::removeBreakpointAt(VirtualAddress address)
 {
-    auto it = m_breakpoints.find(address);
+    Locker locker { m_lock };
+    uint8_t* pc = m_addressToPC.take(address);
+    if (!pc)
+        return false;
+
+    auto it = m_breakpoints.find(pc);
     RELEASE_ASSERT(it != m_breakpoints.end());
-    dataLogLnIf(Options::verboseWasmDebugger(), "[BreakpointManager] Removing breakpoint ", it->value, " at ", address);
-    it->value->restorePatch();
-    m_breakpoints.remove(it);
+    it->value->hasSite = false;
+    releasePatchIfUnused(pc);
     return true;
 }
 
-bool BreakpointManager::removeBreakpoint(VirtualAddress address)
+std::optional<BreakpointManager::TrapAction> BreakpointManager::trapActionFor(uint8_t* pc)
 {
     Locker locker { m_lock };
-    bool removed = removeBreakpointImpl(address);
-    RELEASE_ASSERT(removed);
-    return true;
+    auto it = m_breakpoints.find(pc);
+    if (it == m_breakpoints.end())
+        return std::nullopt;
+
+    // A breakpoint site takes precedence over a step.
+    Breakpoint::Type stopType = it->value->hasSite ? Breakpoint::Type::Regular : Breakpoint::Type::Step;
+    return TrapAction { static_cast<OpType>(it->value->originalBytecode), stopType };
 }
 
 void BreakpointManager::clearAllOneTimeBreakpoints()
 {
     Locker locker { m_lock };
-    for (VirtualAddress address : m_oneTimeBreakpoints)
-        removeBreakpointImpl(address);
-    m_oneTimeBreakpoints.clear();
+    // Cleared first so releasePatchIfUnused can free unreferenced patches.
+    auto steppedPCs = std::exchange(m_oneTimeBreakpoints, { });
+    for (uint8_t* pc : steppedPCs)
+        releasePatchIfUnused(pc);
     dataLogLnIf(Options::verboseWasmDebugger(), "[BreakpointManager] Cleared all one-time breakpoints");
 }
 
@@ -105,7 +137,8 @@ void BreakpointManager::clearAllBreakpoints()
     for (auto& [_, breakpoint] : m_breakpoints)
         breakpoint->restorePatch();
     m_breakpoints.clear();
-    RELEASE_ASSERT(m_oneTimeBreakpoints.isEmpty());
+    m_oneTimeBreakpoints.clear();
+    m_addressToPC.clear();
 }
 
 } // namespace Wasm
 
@@ -29,6 +29,7 @@
 
 #include "WasmDebugServerUtilities.h"
 #include "WasmVirtualAddress.h"
+#include <optional>
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -39,28 +40,39 @@
 namespace JSC {
 namespace Wasm {
 
+// A bytecode patch persists while either a breakpoint site or single-step references it.
 class JS_EXPORT_PRIVATE BreakpointManager {
     WTF_MAKE_TZONE_ALLOCATED(BreakpointManager);
 
 public:
     BreakpointManager() = default;
     ~BreakpointManager();
 
-    bool hasBreakpoints();
+    struct TrapAction {
+        OpType displacedOpcode { OpType::Unreachable };
+        Breakpoint::Type stopType { Breakpoint::Type::Regular };
+    };
+
     bool hasOneTimeBreakpoints();
 
-    RefPtr<Breakpoint> findBreakpoint(VirtualAddress);
-    void setBreakpoint(VirtualAddress, Ref<Breakpoint>&&);
-    bool removeBreakpoint(VirtualAddress);
+    std::optional<TrapAction> trapActionFor(uint8_t* pc);
+
+    void setStepBreakpoint(const ModuleInformation& owner, uint8_t* pc);
     void clearAllOneTimeBreakpoints();
+
+    void setBreakpointAt(VirtualAddress, const ModuleInformation& owner, uint8_t* pc);
+    bool removeBreakpointAt(VirtualAddress);
+
     void clearAllBreakpoints();
 
 private:
-    bool removeBreakpointImpl(VirtualAddress) WTF_REQUIRES_LOCK(m_lock);
+    Breakpoint& ensurePatched(const ModuleInformation& owner, uint8_t* pc) WTF_REQUIRES_LOCK(m_lock);
+    void releasePatchIfUnused(uint8_t* pc) WTF_REQUIRES_LOCK(m_lock);
 
     mutable Lock m_lock;
-    UncheckedKeyHashMap<VirtualAddress, Ref<Breakpoint>> m_breakpoints WTF_GUARDED_BY_LOCK(m_lock);
-    UncheckedKeyHashSet<VirtualAddress> m_oneTimeBreakpoints WTF_GUARDED_BY_LOCK(m_lock);
+    UncheckedKeyHashMap<uint8_t*, Ref<Breakpoint>> m_breakpoints WTF_GUARDED_BY_LOCK(m_lock);
+    UncheckedKeyHashSet<uint8_t*> m_oneTimeBreakpoints WTF_GUARDED_BY_LOCK(m_lock);
+    UncheckedKeyHashMap<VirtualAddress, uint8_t*> m_addressToPC WTF_GUARDED_BY_LOCK(m_lock);
 };
 
 } // namespace Wasm
 
@@ -154,28 +154,25 @@ static const uint8_t* savedWasmToJSPC(CallFrame* wasmToJSFrame)
     return WTF::unalignedLoad<const uint8_t*>(reinterpret_cast<const uint8_t*>(wasmToJSFrame) + Wasm::WasmToJSIPIntReturnPCSlot);
 }
 
-bool getWasmReturnPC(CallFrame* currentFrame, uint8_t*& returnPC, VirtualAddress& virtualReturnPC)
+WasmReturnSite getWasmReturnPC(CallFrame* currentFrame)
 {
     // Safe to use the non-EntryFrame overload: IPInt WASM frames are always entered via a
     // JSToWasm trampoline (a normal CallFrame), never directly from C++, so no EntryFrame
     // boundary can appear immediately above an IPInt frame.
     CallFrame* callerFrame = currentFrame->callerFrame();
 
     if (!callerFrame->callee().isNativeCallee())
-        return false;
+        return { };
 
     RefPtr caller = callerFrame->callee().asNativeCallee();
     if (caller->category() != NativeCallee::Category::Wasm)
-        return false;
+        return { };
 
     RefPtr wasmCaller = uncheckedDowncast<const Wasm::Callee>(caller.get());
     if (wasmCaller->compilationMode() != Wasm::CompilationMode::IPIntMode)
-        return false;
+        return { };
 
-    RefPtr ipintCaller = uncheckedDowncast<const Wasm::IPIntCallee>(wasmCaller.get());
-    returnPC = const_cast<uint8_t*>(savedWasmToWasmPC(currentFrame));
-    virtualReturnPC = VirtualAddress::toVirtual(callerFrame->wasmInstance(), ipintCaller->functionIndex(), returnPC);
-    return true;
+    return { const_cast<uint8_t*>(savedWasmToWasmPC(currentFrame)), callerFrame->wasmInstance() };
 }