Root cause: applyrules() called setmon() which called resize(), but resize() dereferences c->scene_surface->node before c->scene_surface was created in mapnotify(). Fix by storing target monitor/tags in pending_mon/pending_tags fields and calling setmon() after scene nodes exist. The crash affected all new windows, not just Firefox (which was the first tested).