About the Referer with location.replace or location.assign thing: As detailed in my comment at https://github.com/WebKit/WebKit/pull/19093#discussion_r1378090398, testing (from a new test I wrote) indicates that Gecko and Blink set the referrer from the parent frame.

I still don’t clearly know what the particular relevant spec requirement is, so I updated the commit message to remove any claim that the change makes the implementation spec-conformant — and instead just kept the part of the commit message which states it’s for interop/compat with Gecko and Blink.

I need to ping Alex to re-review it again, but I otherwise have no remaining changes of my own to make. If the goal is to have interop on this behavior across all engines, then I think the state of the implementation in the PR branch is what’s necessary for doing that.