moniker_tree_get_rightmost(root) can return the same pointer as the root parameter so node can equal to root. moniker_tree_discard(node) frees node, which could be same as root. Then moniker_create_from_tree(root) could access the already freed pointer.