PassRefPtr is stolen by first agent invocation.

Source/core/inspector/InspectorInstrumentation.idl

 /*
 * Copyright (C) 2013 Google Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 *     * Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 *     * Redistributions in binary form must reproduce the above
@@ skipping 34 matching lines @@
 *           Inline=FastReturn - return early from the inline method if there are no frontends.
 *           Inline=Forward - generate a simple forwarding inline method that does not
                              modify the parameter list (implies Inline=FastReturn)
 *       Attributes without "=" are the names of the agents to be invoked.
 *           Examples: DOM, Page, Debugger.
 *
 *   paramAttr - optional attribute controlling the parameters handling (one attribute per parameter max).
 *       Keep - pass first parameter (used to access the InstrumentingAgents instance) to agents.
 *       FastReturn - return early from the inline method if this parameter is 0/false.
 *
 *   returnValue: C++ return value. Only "void" and "InspectorInstrumentationCookie" are supported.

[aandrey, 2014/03/20 06:16:11]

could you plz add "bool" here?

 *
 *   methodName: C++ name for the public instrumentation method and agents methods.
 *
 *   paramList: C++ parameter list with optional names. Names will be deduced from types if omitted but you have to
 *        specify explicit names for multiple parameters of the same type.
+*
+* Parameters with type PassRefPtr<T> are converted to raw pointers,
+* so reference will not be passed or released until all agents are notified.
 */
 
 interface InspectorInstrumentation {
 
 #include "core/dom/PseudoElement.h"
 
     [Page, Inspector, PageDebugger, PageRuntime]
     void didClearWindowObjectInMainWorld([Keep] LocalFrame*);
 
     [DOMDebugger, Inline=FastReturn]
@@ skipping 466 matching lines @@
 
     [Debugger, Inline=FastReturn]
     void didCreatePromise(ExecutionContext*, const ScriptObject& promise);
 
     [Debugger, Inline=FastReturn]
     void didUpdatePromiseParent(ExecutionContext*, const ScriptObject& promise, const ScriptObject& parentPromise);
 
     [Debugger, Inline=FastReturn]
     void didUpdatePromiseState(ExecutionContext*, const ScriptObject& promise, V8PromiseCustom::PromiseState, const ScriptValue& result);
 }