diff --git a/src/hotspot/share/jfr/jfr.cpp b/src/hotspot/share/jfr/jfr.cpp
index b09a89594ad..d9892f80b6f 100644
--- a/src/hotspot/share/jfr/jfr.cpp
+++ b/src/hotspot/share/jfr/jfr.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2019, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,6 +32,7 @@
 #include "jfr/recorder/repository/jfrEmergencyDump.hpp"
 #include "jfr/recorder/repository/jfrRepository.hpp"
 #include "jfr/recorder/service/jfrOptionSet.hpp"
+#include "jfr/recorder/service/jfrRecorderService.hpp"
 #include "jfr/support/jfrClassDefineEvent.hpp"
 #include "jfr/support/jfrKlassExtension.hpp"
 #include "jfr/support/jfrResolution.hpp"
@@ -43,6 +44,7 @@
 #include "runtime/java.hpp"
 #include "runtime/javaThread.hpp"
 
+
 bool Jfr::is_enabled() {
   return JfrRecorder::is_enabled();
 }
@@ -153,9 +155,9 @@ void Jfr::on_resolution(const Method* caller, const Method* target, TRAPS) {
 }
 #endif
 
-void Jfr::on_vm_shutdown(bool emit_old_object_samples, bool emit_event_shutdown, bool halt) {
+void Jfr::on_vm_shutdown(bool exception_handler /* false */, bool halt /* false */, bool oom /* false */) {
   if (!halt && JfrRecorder::is_recording()) {
-    JfrEmergencyDump::on_vm_shutdown(emit_old_object_samples, emit_event_shutdown);
+    JfrEmergencyDump::on_vm_shutdown(exception_handler, oom);
   }
 }
 
@@ -173,6 +175,12 @@ bool Jfr::on_start_flight_recording_option(const JavaVMOption** option, char* de
   return JfrOptionSet::parse_start_flight_recording_option(option, delimiter);
 }
 
+void Jfr::on_report_java_out_of_memory() {
+  if (CrashOnOutOfMemoryError && JfrRecorder::is_recording()) {
+    JfrRecorderService::emit_leakprofiler_events_on_oom();
+  }
+}
+
 #if INCLUDE_CDS
 void Jfr::on_restoration(const Klass* k, JavaThread* jt) {
   assert(k != nullptr, "invariant");
diff --git a/src/hotspot/share/jfr/jfr.hpp b/src/hotspot/share/jfr/jfr.hpp
index db567cc9a29..ac6a232dda1 100644
--- a/src/hotspot/share/jfr/jfr.hpp
+++ b/src/hotspot/share/jfr/jfr.hpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -71,7 +71,7 @@ class Jfr : AllStatic {
   static void on_resolution(const Method* caller, const Method* target, TRAPS);
   static void on_java_thread_start(JavaThread* starter, JavaThread* startee);
   static void on_set_current_thread(JavaThread* jt, oop thread);
-  static void on_vm_shutdown(bool emit_old_object_samples, bool emit_event_shutdown, bool halt = false);
+  static void on_vm_shutdown(bool exception_handler = false, bool halt = false, bool oom = false);
   static void on_vm_error_report(outputStream* st);
   static bool on_flight_recorder_option(const JavaVMOption** option, char* delimiter);
   static bool on_start_flight_recording_option(const JavaVMOption** option, char* delimiter);
@@ -79,6 +79,7 @@ class Jfr : AllStatic {
   static void initialize_main_thread(JavaThread* jt);
   static bool has_sample_request(JavaThread* jt);
   static void check_and_process_sample_request(JavaThread* jt);
+  static void on_report_java_out_of_memory();
   CDS_ONLY(static void on_restoration(const Klass* k, JavaThread* jt);)
 };
 
diff --git a/src/hotspot/share/jfr/jni/jfrJniMethod.cpp b/src/hotspot/share/jfr/jni/jfrJniMethod.cpp
index 6a1146587bc..d8a30f9b5ee 100644
--- a/src/hotspot/share/jfr/jni/jfrJniMethod.cpp
+++ b/src/hotspot/share/jfr/jni/jfrJniMethod.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -364,8 +364,7 @@ JVM_ENTRY_NO_ENV(void, jfr_set_force_instrumentation(JNIEnv* env, jclass jvm, jb
 JVM_END
 
 NO_TRANSITION(void, jfr_emit_old_object_samples(JNIEnv* env, jclass jvm, jlong cutoff_ticks, jboolean emit_all, jboolean skip_bfs))
-  JfrRecorderService service;
-  service.emit_leakprofiler_events(cutoff_ticks, emit_all == JNI_TRUE, skip_bfs == JNI_TRUE);
+  JfrRecorderService::emit_leakprofiler_events(cutoff_ticks, emit_all == JNI_TRUE, skip_bfs == JNI_TRUE);
 NO_TRANSITION_END
 
 JVM_ENTRY_NO_ENV(void, jfr_exclude_thread(JNIEnv* env, jclass jvm, jobject t))
diff --git a/src/hotspot/share/jfr/recorder/repository/jfrEmergencyDump.cpp b/src/hotspot/share/jfr/recorder/repository/jfrEmergencyDump.cpp
index 309ae961808..cdebcbcfcb5 100644
--- a/src/hotspot/share/jfr/recorder/repository/jfrEmergencyDump.cpp
+++ b/src/hotspot/share/jfr/recorder/repository/jfrEmergencyDump.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -38,6 +38,8 @@
 #include "runtime/mutexLocker.hpp"
 #include "runtime/os.hpp"
 #include "runtime/thread.inline.hpp"
+#include "runtime/vmOperations.hpp"
+#include "runtime/vmThread.hpp"
 #include "utilities/growableArray.hpp"
 #include "utilities/ostream.hpp"
 
@@ -460,15 +462,6 @@ static void release_locks(Thread* thread) {
   assert(thread != nullptr, "invariant");
   assert(!thread->is_Java_thread() || JavaThread::cast(thread)->thread_state() == _thread_in_vm, "invariant");
 
-#ifdef ASSERT
-  Mutex* owned_lock = thread->owned_locks();
-  while (owned_lock != nullptr) {
-    Mutex* next = owned_lock->next();
-    owned_lock->unlock();
-    owned_lock = next;
-  }
-#endif // ASSERT
-
   if (Threads_lock->owned_by_self()) {
     Threads_lock->unlock();
   }
@@ -550,17 +543,14 @@ class JavaThreadInVMAndNative : public StackObj {
   }
 };
 
-static void post_events(bool emit_old_object_samples, bool emit_event_shutdown, Thread* thread) {
-  if (emit_old_object_samples) {
-    LeakProfiler::emit_events(max_jlong, false, false);
-  }
-  if (emit_event_shutdown) {
+static void post_events(bool exception_handler, bool oom, Thread * thread) {
+  if (exception_handler) {
     EventShutdown e;
-    e.set_reason("VM Error");
+    e.set_reason(oom ? "CrashOnOutOfMemoryError" : "VM Error");
     e.commit();
   }
   EventDumpReason event;
-  event.set_reason(emit_old_object_samples ? "Out of Memory" : "Crash");
+  event.set_reason(exception_handler && oom ? "CrashOnOutOfMemoryError" : exception_handler ? "Crash" : "Out of Memory");
   event.set_recordingId(-1);
   event.commit();
 }
@@ -594,20 +584,40 @@ static bool guard_reentrancy() {
   return false;
 }
 
-void JfrEmergencyDump::on_vm_shutdown(bool emit_old_object_samples, bool emit_event_shutdown) {
+void JfrEmergencyDump::on_vm_shutdown(bool exception_handler, bool oom) {
   if (!guard_reentrancy()) {
     return;
   }
+
   Thread* const thread = Thread::current_or_null_safe();
   assert(thread != nullptr, "invariant");
-  if (thread->is_Watcher_thread()) {
-    log_info(jfr, system)("The Watcher thread crashed so no jfr emergency dump will be generated.");
-    return;
-  }
+
   // Ensure a JavaThread is _thread_in_vm when we make this call
   JavaThreadInVMAndNative jtivm(thread);
+  post_events(exception_handler, oom, thread);
+
+  if (thread->is_Watcher_thread()) {
+    // We cannot attempt an emergency dump using the Watcher thread
+    // because we rely on the WatcherThread task "is_error_reported()",
+    // to exit the VM after a hardcoded timeout, should the relatively
+    // risky operation of an emergency dump fail (deadlock, livelock).
+    log_warning(jfr, system)
+      ("The Watcher thread crashed so no jfr emergency dump will be generated.");
+    return;
+  }
+
+  if (thread->is_VM_thread()) {
+    const VM_Operation* const operation = VMThread::vm_operation();
+    if (operation != nullptr && operation->type() == VM_Operation::VMOp_JFROldObject) {
+      // We will not be able to issue a rotation because the rotation lock
+      // is held by the JFR Recorder Thread that issued the VM_Operation.
+      log_warning(jfr, system)
+        ("The VM Thread crashed as part of emitting leak profiler events so no jfr emergency dump will be generated.");
+      return;
+    }
+  }
+
   release_locks(thread);
-  post_events(emit_old_object_samples, emit_event_shutdown, thread);
 
   // if JavaThread, transition to _thread_in_native to issue a final flushpoint
   NoHandleMark nhm;
diff --git a/src/hotspot/share/jfr/recorder/repository/jfrEmergencyDump.hpp b/src/hotspot/share/jfr/recorder/repository/jfrEmergencyDump.hpp
index 04c2851a516..b337d73364a 100644
--- a/src/hotspot/share/jfr/recorder/repository/jfrEmergencyDump.hpp
+++ b/src/hotspot/share/jfr/recorder/repository/jfrEmergencyDump.hpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -39,7 +39,7 @@ class JfrEmergencyDump : AllStatic {
   static const char* chunk_path(const char* repository_path);
   static void on_vm_error(const char* repository_path);
   static void on_vm_error_report(outputStream* st, const char* repository_path);
-  static void on_vm_shutdown(bool emit_old_object_samples, bool emit_event_shutdown);
+  static void on_vm_shutdown(bool exception_handler, bool oom);
 };
 
 #endif // SHARE_JFR_RECORDER_REPOSITORY_JFREMERGENCYDUMP_HPP
diff --git a/src/hotspot/share/jfr/recorder/service/jfrPostBox.cpp b/src/hotspot/share/jfr/recorder/service/jfrPostBox.cpp
index a9ba456ad76..6db7a42ab27 100644
--- a/src/hotspot/share/jfr/recorder/service/jfrPostBox.cpp
+++ b/src/hotspot/share/jfr/recorder/service/jfrPostBox.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -34,7 +34,8 @@
                              (MSGBIT(MSG_START))  |          \
                              (MSGBIT(MSG_CLONE_IN_MEMORY)) | \
                              (MSGBIT(MSG_VM_ERROR))        | \
-                             (MSGBIT(MSG_FLUSHPOINT))        \
+                             (MSGBIT(MSG_FLUSHPOINT))      | \
+                             (MSGBIT(MSG_EMIT_LEAKP_REFCHAINS)) \
                            )
 
 static JfrPostBox* _instance = nullptr;
@@ -165,7 +166,7 @@ void JfrPostBox::notify_waiters() {
   assert(JfrMsg_lock->owned_by_self(), "incrementing _msg_handled_serial is protected by JfrMsg_lock.");
   // Update made visible on release of JfrMsg_lock via fence instruction in Monitor::IUnlock.
   ++_msg_handled_serial;
-  JfrMsg_lock->notify();
+  JfrMsg_lock->notify_all();
 }
 
 // safeguard to ensure no threads are left waiting
diff --git a/src/hotspot/share/jfr/recorder/service/jfrPostBox.hpp b/src/hotspot/share/jfr/recorder/service/jfrPostBox.hpp
index 10457261643..92f70b1dc9b 100644
--- a/src/hotspot/share/jfr/recorder/service/jfrPostBox.hpp
+++ b/src/hotspot/share/jfr/recorder/service/jfrPostBox.hpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -43,6 +43,7 @@ enum JFR_Msg {
   MSG_SHUTDOWN,
   MSG_VM_ERROR,
   MSG_FLUSHPOINT,
+  MSG_EMIT_LEAKP_REFCHAINS,
   MSG_NO_OF_MSGS
 };
 
@@ -51,23 +52,25 @@ enum JFR_Msg {
  *
  *  Synchronous messages (posting thread waits for message completion):
  *
- *  MSG_CLONE_IN_MEMORY (0) ; MSGBIT(MSG_CLONE_IN_MEMORY) == (1 << 0) == 0x1
- *  MSG_START(1)            ; MSGBIT(MSG_START) == (1 << 0x1) == 0x2
- *  MSG_STOP (2)            ; MSGBIT(MSG_STOP) == (1 << 0x2) == 0x4
- *  MSG_ROTATE (3)          ; MSGBIT(MSG_ROTATE) == (1 << 0x3) == 0x8
- *  MSG_VM_ERROR (8)        ; MSGBIT(MSG_VM_ERROR) == (1 << 0x8) == 0x100
- *  MSG_FLUSHPOINT (9)     ; MSGBIT(MSG_FLUSHPOINT) == (1 << 0x9) == 0x200
+ *  MSG_CLONE_IN_MEMORY (0)      ; MSGBIT(MSG_CLONE_IN_MEMORY) == (1 << 0) == 0x1
+ *  MSG_START(1)                 ; MSGBIT(MSG_START) == (1 << 0x1) == 0x2
+ *  MSG_STOP (2)                 ; MSGBIT(MSG_STOP) == (1 << 0x2) == 0x4
+ *  MSG_ROTATE (3)               ; MSGBIT(MSG_ROTATE) == (1 << 0x3) == 0x8
+ *  MSG_VM_ERROR (8)             ; MSGBIT(MSG_VM_ERROR) == (1 << 0x8) == 0x100
+ *  MSG_FLUSHPOINT (9)           ; MSGBIT(MSG_FLUSHPOINT) == (1 << 0x9) == 0x200
+ *  MSG_EMIT_LEAKP_REFCHAINS (10); MSGBIT(MSG_EMIT_LEAKP_REFCHAINS) == (1 << 0xa) == 0x400
  *
  *  Asynchronous messages (posting thread returns immediately upon deposit):
  *
- *  MSG_FULLBUFFER (4)      ; MSGBIT(MSG_FULLBUFFER) == (1 << 0x4) == 0x10
- *  MSG_CHECKPOINT (5)      ; MSGBIT(CHECKPOINT) == (1 << 0x5) == 0x20
- *  MSG_WAKEUP (6)          ; MSGBIT(WAKEUP) == (1 << 0x6) == 0x40
- *  MSG_SHUTDOWN (7)        ; MSGBIT(MSG_SHUTDOWN) == (1 << 0x7) == 0x80
+ *  MSG_FULLBUFFER (4)           ; MSGBIT(MSG_FULLBUFFER) == (1 << 0x4) == 0x10
+ *  MSG_CHECKPOINT (5)           ; MSGBIT(CHECKPOINT) == (1 << 0x5) == 0x20
+ *  MSG_WAKEUP (6)               ; MSGBIT(WAKEUP) == (1 << 0x6) == 0x40
+ *  MSG_SHUTDOWN (7)             ; MSGBIT(MSG_SHUTDOWN) == (1 << 0x7) == 0x80
  */
 
 class JfrPostBox : public JfrCHeapObj {
   friend class JfrRecorder;
+  friend class JfrRecorderService;
  public:
   void post(JFR_Msg msg);
 
diff --git a/src/hotspot/share/jfr/recorder/service/jfrRecorderService.cpp b/src/hotspot/share/jfr/recorder/service/jfrRecorderService.cpp
index 08250a1ae59..6f8d44fb1a4 100644
--- a/src/hotspot/share/jfr/recorder/service/jfrRecorderService.cpp
+++ b/src/hotspot/share/jfr/recorder/service/jfrRecorderService.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2016, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -55,6 +55,7 @@
 #include "runtime/safepoint.hpp"
 #include "runtime/vmOperations.hpp"
 #include "runtime/vmThread.hpp"
+#include "utilities/growableArray.hpp"
 
 // incremented on each flushpoint
 static u8 flushpoint_id = 0;
@@ -391,6 +392,7 @@ class JfrSafepointWriteVMOperation : public VM_Operation {
 JfrRecorderService::JfrRecorderService() :
   _checkpoint_manager(JfrCheckpointManager::instance()),
   _chunkwriter(JfrRepository::chunkwriter()),
+  _post_box(JfrPostBox::instance()),
   _repository(JfrRepository::instance()),
   _stack_trace_repository(JfrStackTraceRepository::instance()),
   _storage(JfrStorage::instance()),
@@ -670,17 +672,173 @@ void JfrRecorderService::evaluate_chunk_size_for_rotation() {
   JfrChunkRotation::evaluate(_chunkwriter);
 }
 
-void JfrRecorderService::emit_leakprofiler_events(int64_t cutoff_ticks, bool emit_all, bool skip_bfs) {
-  DEBUG_ONLY(JfrJavaSupport::check_java_thread_in_native(JavaThread::current()));
-  // Take the rotation lock to exclude flush() during event emits. This is because event emit
-  // also creates a number checkpoint events. Those checkpoint events require a future typeset checkpoint
-  // event for completeness, i.e. to be generated before being flushed to a segment.
-  // The upcoming flush() or rotation() after event emit completes this typeset checkpoint
-  // and serializes all event emit checkpoint events to the same segment.
-  JfrRotationLock lock;
-  // Take the rotation lock before the transition.
-  JavaThread* current_thread = JavaThread::current();
-  MACOS_AARCH64_ONLY(ThreadWXEnable __wx(WXWrite, current_thread));
-  ThreadInVMfromNative transition(current_thread);
-  LeakProfiler::emit_events(cutoff_ticks, emit_all, skip_bfs);
+// LeakProfiler event serialization support.
+
+struct JfrLeakProfilerEmitRequest {
+  int64_t cutoff_ticks;
+  bool emit_all;
+  bool skip_bfs;
+  bool oom;
+};
+
+typedef GrowableArrayCHeap<JfrLeakProfilerEmitRequest, mtTracing> JfrLeakProfilerEmitRequestQueue;
+static JfrLeakProfilerEmitRequestQueue* _queue = nullptr;
+constexpr const static int64_t _no_path_to_gc_roots = 0;
+static bool _oom_emit_request_posted = false;
+static bool _oom_emit_request_delivered = false;
+
+static inline bool exclude_paths_to_gc_roots(int64_t cutoff_ticks) {
+  return cutoff_ticks <= _no_path_to_gc_roots;
+}
+
+static void enqueue(const JfrLeakProfilerEmitRequest& request) {
+  assert(JfrRotationLock::is_owner(), "invariant");
+  if (_queue == nullptr) {
+    _queue = new JfrLeakProfilerEmitRequestQueue(4);
+  }
+  assert(_queue != nullptr, "invariant");
+  assert(!_oom_emit_request_posted, "invariant");
+  if (request.oom) {
+    _oom_emit_request_posted = true;
+  }
+  _queue->append(request);
+}
+
+static JfrLeakProfilerEmitRequest dequeue() {
+  assert(JfrRotationLock::is_owner(), "invariant");
+  assert(_queue != nullptr, "invariant");
+  assert(_queue->is_nonempty(), "invariant");
+  const JfrLeakProfilerEmitRequest& request = _queue->first();
+  _queue->remove_at(0);
+  return request;
+}
+
+// This version of emit excludes path-to-gc-roots, i.e. it skips reference chains.
+static void emit_leakprofiler_events(bool emit_all, bool skip_bfs, JavaThread* jt) {
+  assert(jt != nullptr, "invariant");
+  DEBUG_ONLY(JfrJavaSupport::check_java_thread_in_native(jt));
+  // Take the rotation lock to exclude flush() during event emits. This is because the event emit operation
+  // also creates a number of checkpoint events. Those checkpoint events require a future typeset checkpoint
+  // event for completeness, i.e., to be generated before being flushed to a segment.
+  // The upcoming flush() or rotation() after event emit completes this typeset checkpoint
+  // and serializes all checkpoint events to the same segment.
+  JfrRotationLock lock;
+  // Take the rotation lock before the thread transition, to avoid blocking safepoints.
+  if (_oom_emit_request_posted) {
+    // A request to emit leakprofiler events in response to CrashOnOutOfMemoryError
+    // is pending or has already been completed. We are about to crash at any time now.
+    assert(CrashOnOutOfMemoryError, "invariant");
+    return;
+  }
+  MACOS_AARCH64_ONLY(ThreadWXEnable __wx(WXWrite, jt));
+  ThreadInVMfromNative transition(jt);
+  // Since we are not requesting path-to-gc-roots, i.e., reference chains, we need not issue a VM_Operation.
+  // Therefore, we can let the requesting thread process the request directly, since it already holds the requisite lock.
+  LeakProfiler::emit_events(_no_path_to_gc_roots, emit_all, skip_bfs);
+}
+
+void JfrRecorderService::transition_and_post_leakprofiler_emit_msg(JavaThread* jt) {
+  assert(jt != nullptr, "invariant");
+  DEBUG_ONLY(JfrJavaSupport::check_java_thread_in_native(jt);)
+  assert(!JfrRotationLock::is_owner(), "invariant");
+  // Transition to _thread_in_VM and post a synchronous message to the JFR Recorder Thread
+  // for it to process our enqueued request, which includes paths-to-gc-roots, i.e., reference chains.
+  MACOS_AARCH64_ONLY(ThreadWXEnable __wx(WXWrite, jt));
+  ThreadInVMfromNative transition(jt);
+  _post_box.post(MSG_EMIT_LEAKP_REFCHAINS);
+}
+
+// This version of emit includes path-to-gc-roots, i.e., it includes in the request traversing of reference chains.
+// Traversing reference chains is performed as part of a VM_Operation, and we initiate it from the JFR Recorder Thread.
+// Because multiple threads can concurrently report_on_java_out_of_memory(), having them all post a synchronous JFR msg,
+// they rendezvous at a safepoint in a convenient state, ThreadBlockInVM. This mechanism prevents any thread from racing past
+// this point and begin executing VMError::report_and_die(), until at least one oom request has been delivered.
+void JfrRecorderService::emit_leakprofiler_events_paths_to_gc_roots(int64_t cutoff_ticks,
+                                                                    bool emit_all,
+                                                                    bool skip_bfs,
+                                                                    bool oom,
+                                                                    JavaThread* jt) {
+  assert(jt != nullptr, "invariant");
+  DEBUG_ONLY(JfrJavaSupport::check_java_thread_in_native(jt);)
+  assert(!exclude_paths_to_gc_roots(cutoff_ticks), "invariant");
+
+  {
+    JfrRotationLock lock;
+    // Take the rotation lock to read and post a request for the JFR Recorder Thread.
+    if (_oom_emit_request_posted) {
+      if (!oom) {
+        // A request to emit leakprofiler events in response to CrashOnOutOfMemoryError
+        // is pending or has already been completed. We are about to crash at any time now.
+        assert(CrashOnOutOfMemoryError, "invariant");
+        return;
+      }
+    } else {
+      assert(!_oom_emit_request_posted, "invariant");
+      JfrLeakProfilerEmitRequest request = { cutoff_ticks, emit_all, skip_bfs, oom };
+      enqueue(request);
+    }
+  }
+  JfrRecorderService service;
+  service.transition_and_post_leakprofiler_emit_msg(jt);
+}
+
+// Leakprofiler serialization request, the jdk.jfr.internal.JVM.emitOldObjectSamples() Java entry point.
+void JfrRecorderService::emit_leakprofiler_events(int64_t cutoff_ticks,
+                                                  bool emit_all,
+                                                  bool skip_bfs) {
+  JavaThread* const jt = JavaThread::current();
+  DEBUG_ONLY(JfrJavaSupport::check_java_thread_in_native(jt);)
+  if (exclude_paths_to_gc_roots(cutoff_ticks)) {
+    ::emit_leakprofiler_events(emit_all, skip_bfs, jt);
+    return;
+  }
+  emit_leakprofiler_events_paths_to_gc_roots(cutoff_ticks, emit_all, skip_bfs, /* oom */ false, jt);
+}
+
+// Leakprofiler serialization request, the report_on_java_out_of_memory VM entry point.
+void JfrRecorderService::emit_leakprofiler_events_on_oom() {
+  assert(CrashOnOutOfMemoryError, "invariant");
+  if (EventOldObjectSample::is_enabled()) {
+    JavaThread* const jt = JavaThread::current();
+    DEBUG_ONLY(JfrJavaSupport::check_java_thread_in_vm(jt);)
+    ThreadToNativeFromVM transition(jt);
+    emit_leakprofiler_events_paths_to_gc_roots(max_jlong, false, false, /* oom */ true, jt);
+  }
+}
+
+// The worker routine for the JFR Recorder Thread when processing MSG_EMIT_LEAKP_REFCHAINS messages.
+void JfrRecorderService::emit_leakprofiler_events() {
+  JavaThread* const jt = JavaThread::current();
+  DEBUG_ONLY(JfrJavaSupport::check_java_thread_in_native(jt));
+  // Take the rotation lock before the transition.
+  JfrRotationLock lock;
+  if (_oom_emit_request_delivered) {
+    // A request to emit leakprofiler events in response to CrashOnOutOfMemoryError
+    // has already been completed. We are about to crash at any time now.
+    assert(_oom_emit_request_posted, "invariant");
+    assert(CrashOnOutOfMemoryError, "invariant");
+    return;
+  }
+
+  assert(_queue->is_nonempty(), "invariant");
+
+  {
+    MACOS_AARCH64_ONLY(ThreadWXEnable __wx(WXWrite, jt));
+    ThreadInVMfromNative transition(jt);
+    while (_queue->is_nonempty()) {
+      const JfrLeakProfilerEmitRequest& request = dequeue();
+      LeakProfiler::emit_events(request.cutoff_ticks, request.emit_all, request.skip_bfs);
+      if (_oom_emit_request_posted && request.oom) {
+        assert(CrashOnOutOfMemoryError, "invariant");
+        _oom_emit_request_delivered = true;
+        break;
+      }
+    }
+  }
+
+  // If processing involved an out-of-memory request, issue an immediate flush operation.
+  DEBUG_ONLY(JfrJavaSupport::check_java_thread_in_native(jt));
+  if (_chunkwriter.is_valid() && _oom_emit_request_delivered) {
+    invoke_flush();
+  }
 }
diff --git a/src/hotspot/share/jfr/recorder/service/jfrRecorderService.hpp b/src/hotspot/share/jfr/recorder/service/jfrRecorderService.hpp
index e5b4500afc0..3759ff98828 100644
--- a/src/hotspot/share/jfr/recorder/service/jfrRecorderService.hpp
+++ b/src/hotspot/share/jfr/recorder/service/jfrRecorderService.hpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2016, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -27,19 +27,23 @@
 
 #include "jfr/utilities/jfrAllocation.hpp"
 
+class JavaThread;
 class JfrCheckpointManager;
 class JfrChunkWriter;
+class JfrPostBox;
 class JfrRepository;
 class JfrStackTraceRepository;
 class JfrStorage;
 class JfrStringPool;
 
 class JfrRecorderService : public StackObj {
+  friend class Jfr;
   friend class JfrSafepointClearVMOperation;
   friend class JfrSafepointWriteVMOperation;
  private:
   JfrCheckpointManager& _checkpoint_manager;
   JfrChunkWriter& _chunkwriter;
+  JfrPostBox& _post_box;
   JfrRepository& _repository;
   JfrStackTraceRepository& _stack_trace_repository;
   JfrStorage& _storage;
@@ -64,6 +68,14 @@ class JfrRecorderService : public StackObj {
   void invoke_safepoint_write();
   void post_safepoint_write();
 
+  void transition_and_post_leakprofiler_emit_msg(JavaThread* jt);
+
+  static void emit_leakprofiler_events_on_oom();
+  static void emit_leakprofiler_events_paths_to_gc_roots(int64_t cutoff_ticks,
+                                                         bool emit_all,
+                                                         bool skip_bfs,
+                                                         bool oom,
+                                                         JavaThread* jt);
  public:
   JfrRecorderService();
   void start();
@@ -72,8 +84,12 @@ class JfrRecorderService : public StackObj {
   void flushpoint();
   void process_full_buffers();
   void evaluate_chunk_size_for_rotation();
-  void emit_leakprofiler_events(int64_t cutoff_ticks, bool emit_all, bool skip_bfs);
+  void emit_leakprofiler_events();
+
   static bool is_recording();
+  static void emit_leakprofiler_events(int64_t cutoff_ticks,
+                                       bool emit_all,
+                                       bool skip_bfs);
 };
 
 #endif // SHARE_JFR_RECORDER_SERVICE_JFRRECORDERSERVICE_HPP
diff --git a/src/hotspot/share/jfr/recorder/service/jfrRecorderThreadLoop.cpp b/src/hotspot/share/jfr/recorder/service/jfrRecorderThreadLoop.cpp
index de015e9a502..bd01adf5b3a 100644
--- a/src/hotspot/share/jfr/recorder/service/jfrRecorderThreadLoop.cpp
+++ b/src/hotspot/share/jfr/recorder/service/jfrRecorderThreadLoop.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -44,6 +44,7 @@ void recorderthread_entry(JavaThread* thread, JavaThread* unused) {
   #define ROTATE (msgs & (MSGBIT(MSG_ROTATE)|MSGBIT(MSG_STOP)))
   #define FLUSHPOINT (msgs & (MSGBIT(MSG_FLUSHPOINT)))
   #define PROCESS_FULL_BUFFERS (msgs & (MSGBIT(MSG_ROTATE)|MSGBIT(MSG_STOP)|MSGBIT(MSG_FULLBUFFER)))
+  #define LEAKPROFILER_REFCHAINS (msgs & MSGBIT(MSG_EMIT_LEAKP_REFCHAINS))
 
   JfrPostBox& post_box = JfrRecorderThreadEntry::post_box();
   log_debug(jfr, system)("Recorder thread STARTED");
@@ -70,6 +71,9 @@ void recorderthread_entry(JavaThread* thread, JavaThread* unused) {
         if (PROCESS_FULL_BUFFERS) {
           service.process_full_buffers();
         }
+        if (LEAKPROFILER_REFCHAINS) {
+          service.emit_leakprofiler_events();
+        }
         // Check amount of data written to chunk already
         // if it warrants asking for a new chunk.
         service.evaluate_chunk_size_for_rotation();
@@ -98,5 +102,5 @@ void recorderthread_entry(JavaThread* thread, JavaThread* unused) {
   #undef ROTATE
   #undef FLUSHPOINT
   #undef PROCESS_FULL_BUFFERS
-  #undef SCAVENGE
+  #undef LEAKPROFILER_REFCHAINS
 }
diff --git a/src/hotspot/share/runtime/java.cpp b/src/hotspot/share/runtime/java.cpp
index c49a9f5d4b8..ee4f776df06 100644
--- a/src/hotspot/share/runtime/java.cpp
+++ b/src/hotspot/share/runtime/java.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -466,10 +466,7 @@ void before_exit(JavaThread* thread, bool halt) {
     event.commit();
   }
 
-  // 2nd argument (emit_event_shutdown) should be set to false
-  // because EventShutdown would be emitted at Threads::destroy_vm().
-  // (one of the callers of before_exit())
-  JFR_ONLY(Jfr::on_vm_shutdown(true, false, halt);)
+  JFR_ONLY(Jfr::on_vm_shutdown(false, halt);)
 
   // Stop the WatcherThread. We do this before disenrolling various
   // PeriodicTasks to reduce the likelihood of races.
diff --git a/src/hotspot/share/utilities/debug.cpp b/src/hotspot/share/utilities/debug.cpp
index de39fe32dc1..9e167141259 100644
--- a/src/hotspot/share/utilities/debug.cpp
+++ b/src/hotspot/share/utilities/debug.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -63,6 +63,9 @@
 #include "utilities/nativeStackPrinter.hpp"
 #include "utilities/unsigned5.hpp"
 #include "utilities/vmError.hpp"
+#if INCLUDE_JFR
+#include "jfr/jfr.hpp"
+#endif
 
 #include <stdarg.h>
 #include <stdio.h>
@@ -262,6 +265,8 @@ void report_untested(const char* file, int line, const char* message) {
 void report_java_out_of_memory(const char* message) {
   static int out_of_memory_reported = 0;
 
+  JFR_ONLY(Jfr::on_report_java_out_of_memory();)
+
   // A number of threads may attempt to report OutOfMemoryError at around the
   // same time. To avoid dumping the heap or executing the data collection
   // commands multiple times we just do it once when the first threads reports
diff --git a/src/hotspot/share/utilities/vmError.cpp b/src/hotspot/share/utilities/vmError.cpp
index a290602e0be..88f81b31293 100644
--- a/src/hotspot/share/utilities/vmError.cpp
+++ b/src/hotspot/share/utilities/vmError.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2026, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2017, 2024 SAP SE. All rights reserved.
  * Copyright (c) 2023, 2025, Red Hat, Inc. and/or its affiliates.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
@@ -1898,7 +1898,7 @@ void VMError::report_and_die(int id, const char* message, const char* detail_fmt
     log.set_fd(-1);
   }
 
-  JFR_ONLY(Jfr::on_vm_shutdown(static_cast<VMErrorType>(_id) == OOM_JAVA_HEAP_FATAL, true);)
+  JFR_ONLY(Jfr::on_vm_shutdown(true, false, static_cast<VMErrorType>(_id) == OOM_JAVA_HEAP_FATAL);)
 
   if (PrintNMTStatistics) {
     fdStream fds(fd_out);
diff --git a/test/jdk/ProblemList.txt b/test/jdk/ProblemList.txt
index 9cfc23ea8da..291b2163b0d 100644
--- a/test/jdk/ProblemList.txt
+++ b/test/jdk/ProblemList.txt
@@ -710,7 +710,6 @@ jdk/incubator/vector/LoadJsvmlTest.java                         8305390 windows-
 # jdk_jfr
 
 jdk/jfr/event/compiler/TestCodeSweeper.java                     8338127 generic-all
-jdk/jfr/event/oldobject/TestEmergencyDumpAtOOM.java             8371014 aix-ppc64,linux-ppc64le
 jdk/jfr/event/oldobject/TestShenandoah.java                     8342951 generic-all
 jdk/jfr/event/runtime/TestResidentSetSizeEvent.java             8309846 aix-ppc64
 jdk/jfr/jvm/TestWaste.java                                      8371630 generic-all
diff --git a/test/jdk/jdk/jfr/event/oldobject/TestEmergencyDumpAtOOM.java b/test/jdk/jdk/jfr/event/oldobject/TestEmergencyDumpAtOOM.java
index d540acd853b..b3630fa7f77 100644
--- a/test/jdk/jdk/jfr/event/oldobject/TestEmergencyDumpAtOOM.java
+++ b/test/jdk/jdk/jfr/event/oldobject/TestEmergencyDumpAtOOM.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2025, NTT DATA.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
@@ -98,8 +98,8 @@ public class TestEmergencyDumpAtOOM {
             // Check OldObjectSample events
             if (oldObjects.get() > 0L) {
                 if (shouldCrash) {
-                    Asserts.assertEquals("VM Error", shutdownReason.get());
-                    Asserts.assertEquals("Out of Memory", dumpReason.get());
+                    Asserts.assertEquals("CrashOnOutOfMemoryError", shutdownReason.get());
+                    Asserts.assertEquals("CrashOnOutOfMemoryError", dumpReason.get());
                 } else {
                     Asserts.assertEquals("No remaining non-daemon Java threads", shutdownReason.get());
                 }