Add crashtest for bug 307298.

layout/xul/base/src/tree/src/crashtests/307298-1.xul

@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="var tree = document.getElementById('tree'), treeitem = document.getElementById('treeitem'); tree.parentNode.insertBefore(treeitem, tree);">
+
+<tree flex="1" id="tree">
+  <treecols>
+    <treecol id="name" label="Name" primary="true" flex="1"/>
+  </treecols>
+
+  <treechildren>
+    <treeitem id="treeitem">
+      <treerow>
+        <treecell label="Click the button below to crash"/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+</tree>
+
+</window>

layout/xul/base/src/tree/src/crashtests/crashtests.list

@@ -0,0 +1 @@
+load 307298-1.xul

testing/crashtest/crashtests.list

@@ -5,3 +5,5 @@ include ../../testing/crashtest/sanity/crashtests.list
 include ../../gfx/src/mac/crashtests/crashtests.list
 include ../../layout/base/crashtests/crashtests.list
 include ../../layout/xul/base/src/grid/crashtests/crashtests.list
+include ../../layout/xul/base/src/tree/src/crashtests/crashtests.list
+