Bug 224723 NS_ASSERTION(boxObject, "no box object!"); timer fired after tree was destroyed

r=varga sr=dbaron

layout/xul/base/src/tree/src/nsTreeSelection.cpp

@@ -285,6 +285,10 @@ NS_IMETHODIMP nsTreeSelection::GetTree(nsITreeBoxObject * *aTree)
 
 NS_IMETHODIMP nsTreeSelection::SetTree(nsITreeBoxObject * aTree)
 {
+  if (mSelectTimer) {
+    mSelectTimer->Cancel();
+    mSelectTimer = nsnull;
+  }
   mTree = aTree; // WEAK
   return NS_OK;
 }