release() should be called on a RefPtr to convert it to a PassRefPtr.
Created attachment 193262 [details] Patch
I believe this happens implicitly: http://trac.webkit.org/browser/trunk/Source/WTF/wtf/PassRefPtr.h#L96
Comment on attachment 193262 [details] Patch Looks right.
Comment on attachment 193262 [details] Patch Clearing flags on attachment: 193262 Committed r145892: <http://trac.webkit.org/changeset/145892>
All reviewed patches have been landed. Closing bug.