Crash: Moving bookmarks into subfolder in incognito window

chrome/browser/cocoa/bookmark_bar_folder_hover_state.mm

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "chrome/browser/cocoa/bookmark_bar_folder_hover_state.h"
 #import "chrome/browser/cocoa/bookmark_bar_controller.h" // namespace bookmarks
 
 @interface BookmarkBarFolderHoverState(Private)
 - (void)setHoverState:(HoverState)state;
 - (void)closeBookmarkFolderOnHoverButton:(BookmarkButton*)button;
@@ skipping 20 matching lines @@
       // This implies we've dragged over a new folder, so we'll close the old
       // and open the new.
       // Note that we only schedule the open or close if we have no other tasks
       // currently pending.
 
       if (hoverState_ == kHoverStateOpen) {
         // Close the old.
         [self scheduleCloseBookmarkFolderOnHoverButton];
       } else if (hoverState_ == kHoverStateClosed) {
         // Open the new.
-        [self scheduleOpenBookmarkFolderOnHoverButton:[button retain]];
+        [self scheduleOpenBookmarkFolderOnHoverButton:button];
       }
     } else if (!hoverButton_) {
       // CASE C: we don't have a current hoverButton_ but we have dragged onto
       // a new folder so we open the new one.
-      [self scheduleOpenBookmarkFolderOnHoverButton:[button retain]];
+      [self scheduleOpenBookmarkFolderOnHoverButton:button];
     }
   } else if (!button) {
     if (hoverButton_) {
       // CASE D: We have a hoverButton_ but we've moved onto an area that
       // requires no hover.  We close the hoverButton_ in this case.  This
       // means cancelling if the open is pending (i.e. |kHoverStateOpening|)
       // or closing if we don't alrealy have once in progress.
 
       // Intiate close only if we have not already done so.
       if (hoverState_ == kHoverStateOpening) {
@@ skipping 36 matching lines @@
   [self setHoverState:kHoverStateOpen];
   [NSObject
       cancelPreviousPerformRequestsWithTarget:self
       selector:@selector(closeBookmarkFolderOnHoverButton:)
       object:hoverButton_];
 }
 
 // Schedule open of hover button.  Transition to kHoverStateOpening state.
 - (void)scheduleOpenBookmarkFolderOnHoverButton:(BookmarkButton*)button {
   DCHECK(button);
-  hoverButton_.reset(button);
+  hoverButton_.reset([button retain]);
   [self setHoverState:kHoverStateOpening];
   [self performSelector:@selector(openBookmarkFolderOnHoverButton:)
              withObject:hoverButton_
              afterDelay:bookmarks::kDragHoverOpenDelay];
 }
 
 // Cancel pending hover open.  Transition to kHoverStateClosed state.
 - (void)cancelPendingOpenBookmarkFolderOnHoverButton {
   [self setHoverState:kHoverStateClosed];
   [NSObject
@@ skipping 48 matching lines @@
 // Called after a delay to open a new hover folder.
 // Note: this method is not meant to be invoked directly, only through
 // a delayed call to |scheduleOpenBookmarkFolderOnHoverButton:|.
 - (void)openBookmarkFolderOnHoverButton:(BookmarkButton*)button {
   [self setHoverState:kHoverStateOpen];
   [[button target] performSelector:@selector(openBookmarkFolderFromButton:)
       withObject:button];
 }
 
 @end