Set mColumns to nsnull after |delete| to prevent a crash. Bug 206437, r+sr=bryner, a=mkaply.

layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp

@@ -3397,6 +3397,7 @@ nsTreeBodyFrame::EnsureColumns()
 {
   if (!mColumns || mColumnsDirty) {
     delete mColumns;
+    mColumns = nsnull;
     mColumnsDirty = PR_FALSE;
 
     nsCOMPtr<nsIContent> parent;