Until now, we have removed the listener for `purge_caches` on the destructor. https://searchfox.org/mozilla-central/rev/ee9dab6aa95f167a34cb178960f7375210a0bba4/toolkit/components/places/nsNavHistoryResult.cpp#3482-3484 But, when closing, since NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN will be called before calling the destructor, even if `mRootNode` is unlinked, might capture the `purge_caches` event. https://searchfox.org/mozilla-central/rev/ee9dab6aa95f167a34cb178960f7375210a0bba4/toolkit/components/places/nsNavHistoryResult.cpp#3411 And in the case, it will crash due to touch the null object. In this change, remove the listener before unlinking the `mRootNode` explicitly. Differential Revision: https://phabricator.services.mozilla.com/D111039
