diff --git a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
index de864ef936f..aeef60d813e 100644
--- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
@@ -50,7 +50,6 @@
 #include "nsISupportsArray.h"
 #include "nsPresContext.h"
 #include "nsINameSpaceManager.h"
-#include "nsIScrollbarFrame.h"
 
 #include "nsTreeBodyFrame.h"
 #include "nsTreeSelection.h"
@@ -101,6 +100,7 @@
 #include "nsIScrollableFrame.h"
 #include "nsEventDispatcher.h"
 #include "nsDisplayList.h"
+#include "nsTreeBoxObject.h"
 
 #ifdef IBMBIDI
 #include "nsBidiPresUtils.h"
@@ -222,7 +222,6 @@ nsTreeBodyFrame::Init(nsIContent*     aContent,
 
   NS_ENSURE_TRUE(mImageCache.Init(16), NS_ERROR_OUT_OF_MEMORY);
   EnsureBoxObject();
-  NS_ENSURE_STATE(mTreeBoxObject);
   return rv;
 }
 
@@ -370,8 +369,15 @@ nsTreeBodyFrame::EnsureBoxObject()
       // Ensure that we got a native box object.
       nsCOMPtr<nsPIBoxObject> pBox = do_QueryInterface(box);
       if (pBox) {
-        mTreeBoxObject = do_QueryInterface(pBox);
-        mColumns->SetTree(mTreeBoxObject);
+        nsCOMPtr<nsITreeBoxObject> realTreeBoxObject = do_QueryInterface(pBox);
+        if (realTreeBoxObject) {
+          nsITreeBoxObject* innerTreeBoxObject =
+            NS_STATIC_CAST(nsTreeBoxObject*, realTreeBoxObject.get())->GetTreeBody();
+          ENSURE_TRUE(!innerTreeBoxObject || innerTreeBoxObject ==
+                      NS_STATIC_CAST(nsITreeBoxObject*, this));
+          mTreeBoxObject = realTreeBoxObject;
+          mColumns->SetTree(mTreeBoxObject);
+        }
       }
     }
   }
diff --git a/layout/xul/base/src/tree/src/nsTreeBodyFrame.h b/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
index 2f8d148fdce..86b1c5fb9ad 100644
--- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
+++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
@@ -57,6 +57,7 @@
 #include "nsDataHashtable.h"
 #include "imgIRequest.h"
 #include "imgIDecoderObserver.h"
+#include "nsIScrollbarFrame.h"
 
 // An entry in the tree's image cache
 struct nsTreeImageCacheEntry
@@ -131,6 +132,8 @@ public:
   void PaintTreeBody(nsIRenderingContext& aRenderingContext,
                      const nsRect& aDirtyRect, nsPoint aPt);
 
+  nsITreeBoxObject* GetTreeBoxObject() const { return mTreeBoxObject; }
+
 protected:
   // This method paints a specific column background of the tree.
   void PaintColumn(nsTreeColumn*        aColumn,
diff --git a/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp b/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp
index 843bdfefd14..33f9ea601a8 100644
--- a/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp
@@ -37,47 +37,20 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
+
+#include "nsTreeBoxObject.h"
 #include "nsCOMPtr.h"
-#include "nsPresContext.h"
-#include "nsIPresShell.h"
 #include "nsIDOMXULElement.h"
 #include "nsIXULTemplateBuilder.h"
 #include "nsTreeContentView.h"
-#include "nsITreeView.h"
 #include "nsITreeSelection.h"
-#include "nsBoxObject.h"
-#include "nsIFrame.h"
-#include "nsIAtom.h"
-#include "nsINodeInfo.h"
-#include "nsGkAtoms.h"
 #include "nsChildIterator.h"
 #include "nsContentUtils.h"
 #include "nsDOMError.h"
+#include "nsTreeBodyFrame.h"
 
-class nsTreeBoxObject : public nsITreeBoxObject, public nsBoxObject
-{
-public:
-  NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSITREEBOXOBJECT
-
-  nsTreeBoxObject();
-  ~nsTreeBoxObject();
-
-  nsITreeBoxObject* GetTreeBody();
-
-  //NS_PIBOXOBJECT interfaces
-  virtual void Clear();
-  virtual void ClearCachedValues();
-
-protected:
-  nsITreeBoxObject* mTreeBody;
-  nsCOMPtr<nsITreeView> mView;
-};
-
-/* Implementation file */
 NS_IMPL_ISUPPORTS_INHERITED1(nsTreeBoxObject, nsBoxObject, nsITreeBoxObject)
 
-
 void
 nsTreeBoxObject::Clear()
 {
@@ -158,7 +131,15 @@ nsTreeBoxObject::GetTreeBody()
      return nsnull;
 
   // It's a frame. Refcounts are irrelevant.
-  CallQueryInterface(frame, &mTreeBody);
+  // Make sure that the treebodyframe, which implements nsITreeBoxObject,
+  // has a pointer to |this|.
+  nsITreeBoxObject* innerTreeBoxObject = nsnull;
+  CallQueryInterface(frame, &innerTreeBoxObject);
+  NS_ENSURE_TRUE(innerTreeBoxObject &&
+    NS_STATIC_CAST(nsTreeBodyFrame*, innerTreeBoxObject)->GetTreeBoxObject() ==
+    NS_STATIC_CAST(nsITreeBoxObject*, this), nsnull);
+
+  mTreeBody = innerTreeBoxObject;
   return mTreeBody;
 }
 
diff --git a/layout/xul/base/src/tree/src/nsTreeBoxObject.h b/layout/xul/base/src/tree/src/nsTreeBoxObject.h
new file mode 100644
index 00000000000..04a058c4dd9
--- /dev/null
+++ b/layout/xul/base/src/tree/src/nsTreeBoxObject.h
@@ -0,0 +1,68 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Communicator client code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Dave Hyatt <hyatt@mozilla.org> (Original Author)
+ *   Brian Ryner <bryner@brianryner.com>
+ *   Nate Nielsen <nielsen@memberwebs.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsTreeBoxObject_h___
+#define nsTreeBoxObject_h___
+
+#include "nsBoxObject.h"
+#include "nsITreeView.h"
+#include "nsITreeBoxObject.h"
+
+class nsTreeBoxObject : public nsITreeBoxObject, public nsBoxObject
+{
+public:
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_NSITREEBOXOBJECT
+
+  nsTreeBoxObject();
+  ~nsTreeBoxObject();
+
+  nsITreeBoxObject* GetTreeBody();
+
+  //NS_PIBOXOBJECT interfaces
+  virtual void Clear();
+  virtual void ClearCachedValues();
+
+protected:
+  nsITreeBoxObject* mTreeBody;
+  nsCOMPtr<nsITreeView> mView;
+};
+
+#endif