diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index e3db7d994e26..19930574d595 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,22 @@
+2015-03-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Wrong transfer annotations used in GObject DOM bindings
+        https://bugs.webkit.org/show_bug.cgi?id=142780
+
+        Reviewed by Gustavo Noronha Silva.
+
+        We are using transfer none for all methods returning a GObject DOM
+        Object. That's not true. Only objects derived from Node are
+        automatically released by the DOM object cache and can be transfer
+        none. All other objects are added to the cache only to avoid
+        creating the same wrapper twice for the same core object, but
+        caller should release the returned reference.
+
+        * bindings/gobject/WebKitDOMCustomUnstable.h:
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GetTransferTypeForReturnType):
+        (GenerateFunction):
+
 2015-03-17  Carlos Garcia Campos  <cgarcia@igalia.com>
 
         [GTK] WebKitDOM objects leaking
diff --git a/Source/WebCore/bindings/gobject/WebKitDOMCustomUnstable.h b/Source/WebCore/bindings/gobject/WebKitDOMCustomUnstable.h
index ce1695d0227b..513594718077 100644
--- a/Source/WebCore/bindings/gobject/WebKitDOMCustomUnstable.h
+++ b/Source/WebCore/bindings/gobject/WebKitDOMCustomUnstable.h
@@ -29,7 +29,7 @@ G_BEGIN_DECLS
  * webkit_dom_dom_window_get_webkit_namespace:
  * @self: A #WebKitDOMDOMWindow
  *
- * Returns: (transfer none): A #WebKitDOMWebKitNamespace
+ * Returns: (transfer full): A #WebKitDOMWebKitNamespace
  *
  * Stability: Unstable
  * Since: 2.8
@@ -42,7 +42,7 @@ webkit_dom_dom_window_get_webkit_namespace(WebKitDOMDOMWindow* self);
  * @self: A #WebKitDOMUserMessageHandlersNamespace
  * @name: a #gchar
  *
- * Returns: (transfer none): A #WebKitDOMUserMessageHandler
+ * Returns: (transfer full): A #WebKitDOMUserMessageHandler
  *
  * Stability: Unstable
  * Since: 2.8
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
index f88741cfbd71..4b0efb1805d9 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
@@ -49,6 +49,29 @@ my %baseTypeHash = ("Object" => 1, "Node" => 1, "NodeList" => 1, "NamedNodeMap"
                     "NodeIterator" => 1, "TreeWalker" => 1, "AbstractView" => 1, "Blob" => 1, "DOMTokenList" => 1,
                     "HTMLCollection" => 1, "TextTrackCue" => 1);
 
+# Only objects derived from Node are released by the DOM object cache and can be
+# transfer none. Ideally we could use GetBaseClass with the parent type to check
+# whether it's Node, but unfortunately we only have the name of the return type,
+# and we can't know its parent base class. Since there are fewer classes in the
+# API that are not derived from Node, we will list them here to decide the
+# transfer type.
+my %transferFullTypeHash = ("AudioTrack" => 1, "AudioTrackList" => 1, "BarProp" => 1, "BatteryManager" => 1,
+    "CSSRuleList" => 1, "CSSStyleDeclaration" => 1, "CSSStyleSheet" => 1,
+    "DOMApplicationCache" => 1, "DOMMimeType" => 1, "DOMMimeTypeArray" => 1, "DOMNamedFlowCollection" => 1,
+    "DOMPlugin" => 1, "DOMPluginArray" => 1, "DOMSecurityPolicy" => 1,
+    "DOMSelection" => 1, "DOMSettableTokenList" => 1, "DOMStringList" => 1,
+    "DOMWindow" => 1, "DOMWindowCSS" => 1, "EventTarget" => 1,
+    "File" => 1, "FileList" => 1, "Gamepad" => 1, "GamepadList" => 1,
+    "Geolocation" => 1, "HTMLOptionsCollection" => 1, "History" => 1,
+    "KeyboardEvent" => 1, "MediaError" => 1, "MediaController" => 1,
+    "MouseEvent" => 1, "MediaQueryList" => 1, "Navigator" => 1, "NodeFilter" => 1,
+    "Performance" => 1, "PerformanceEntry" => 1, "PerformanceEntryList" => 1, "PerformanceNavigation" => 1, "PerformanceTiming" => 1,
+    "Range" => 1, "Screen" => 1, "SpeechSynthesis" => 1, "SpeechSynthesisVoice" => 1,
+    "Storage" => 1, "StyleMedia" => 1, "TextTrack" => 1, "TextTrackCueList" => 1,
+    "TimeRanges" => 1, "Touch" => 1, "UIEvent" => 1, "UserMessageHandler" => 1, "UserMessageHandlersNamespace" => 1,
+    "ValidityState" => 1, "VideoTrack" => 1, "WebKitNamedFlow" => 1,
+    "WebKitNamespace" => 1, "WebKitPoint" => 1, "WheelEvent" => 1, "XPathNSResolver" => 1);
+
 # List of function parameters that are allowed to be NULL
 my $canBeNullParams = {
     'webkit_dom_document_create_attribute_ns' => ['namespaceURI'],
@@ -947,6 +970,20 @@ sub GetFunctionSignatureName {
     return "${name}_type";
 }
 
+sub GetTransferTypeForReturnType {
+    my $returnType = shift;
+
+    # Node is always transfer none.
+    return "none" if $returnType eq "Node";
+
+    # Any base class but Node is transfer full.
+    return "full" if IsBaseType($returnType);
+
+    # Any other class not derived from Node is transfer full.
+    return "full" if $transferFullTypeHash{$returnType};
+    return "none";
+}
+
 sub GenerateFunction {
     my ($object, $interfaceName, $function, $prefix, $parentNode) = @_;
 
@@ -1044,7 +1081,8 @@ sub GenerateFunction {
     my $hasReturnTag = 0;
     $returnTypeName =~ s/\*$//;
     if ($returnValueIsGDOMType) {
-        push(@functionHeader, " * Returns: (transfer none): A #${returnTypeName}");
+        my $transferType = GetTransferTypeForReturnType($functionSigType);
+        push(@functionHeader, " * Returns: (transfer $transferType): A #${returnTypeName}");
         $hasReturnTag = 1;
     } elsif ($returnType ne "void") {
         push(@functionHeader, " * Returns: A #${returnTypeName}");