Bug 1809492. Clear pointer to nsTreeBodyFrame on XULTreeElement after any possible calls that can set it. r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D184318

layout/xul/tree/nsTreeBodyFrame.cpp

@@ -314,9 +314,7 @@ void nsTreeBodyFrame::DestroyFrom(nsIFrame* aDestructRoot,
 
   if (mColumns) mColumns->SetTree(nullptr);
 
-  if (mTree) {
-    mTree->BodyDestroyed(mTopRowIndex);
-  }
+  RefPtr tree = mTree;
 
   if (nsCOMPtr<nsITreeView> view = std::move(mView)) {
     nsCOMPtr<nsITreeSelection> sel;
@@ -327,6 +325,15 @@ void nsTreeBodyFrame::DestroyFrom(nsIFrame* aDestructRoot,
     view->SetTree(nullptr);
   }
 
+  // Make this call now because view->SetTree can run js which can undo this
+  // call.
+  if (tree) {
+    tree->BodyDestroyed(mTopRowIndex);
+  }
+  if (mTree && mTree != tree) {
+    mTree->BodyDestroyed(mTopRowIndex);
+  }
+
   SimpleXULLeafFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }