attach_to_workspace: set new parent before tree_render

on_remove_child calls tree_close_internal which calls tree_render and
the tree is in an invalid state if con->parent still points to the old
parent.

Fixes #3556

src/move.c

@@ -178,9 +178,7 @@ void insert_con_into(Con *con, Con *target, position_t position) {
  */
 static void attach_to_workspace(Con *con, Con *ws, direction_t direction) {
     con_detach(con);
-    con_fix_percent(con->parent);
+    Con *old_parent = con->parent;
-    CALL(con->parent, on_remove_child);
-
     con->parent = ws;
 
     if (direction == D_RIGHT || direction == D_DOWN) {
@@ -195,6 +193,9 @@ static void attach_to_workspace(Con *con, Con *ws, direction_t direction) {
      * does not make sense anyways. */
     con->percent = 0.0;
     con_fix_percent(ws);
+
+    con_fix_percent(old_parent);
+    CALL(old_parent, on_remove_child);
 }
 
 /*

testcases/t/303-regress-move-floating.t

@@ -0,0 +1,33 @@
+#!perl
+# vim:ts=4:sw=4:expandtab
+#
+# Please read the following documents before working on tests:
+# • https://build.i3wm.org/docs/testsuite.html
+#   (or docs/testsuite)
+#
+# • https://build.i3wm.org/docs/lib-i3test.html
+#   (alternatively: perldoc ./testcases/lib/i3test.pm)
+#
+# • https://build.i3wm.org/docs/ipc.html
+#   (or docs/ipc)
+#
+# • http://onyxneon.com/books/modern_perl/modern_perl_a4.pdf
+#   (unless you are already familiar with Perl)
+#
+# Regression: moving a container which is the only child of the only child of a
+# floating container crashes i3.
+# Ticket: #3556
+# Bug still in: 4.16-61-g376833db4
+use i3test;
+
+my $ws = fresh_workspace;
+open_window;
+open_window;
+cmd 'split v, focus parent, floating toggle, focus child, move right';
+does_i3_live;
+
+$ws = get_ws($ws);
+is(scalar @{$ws->{floating_nodes}}, 0, 'No floating nodes in workspace');
+is(scalar @{$ws->{nodes}}, 2, 'Two tiling nodes in workspace');
+
+done_testing;