src/core/ngx_resolver.c:240: error: Use After Free
  call to `ngx_rbtree_min()` eventually accesses memory that was invalidated by call to `free()` on line 256 indirectly during the call to `ngx_resolver_free_node()`.

src/core/ngx_resolver.c:232:1: invalidation part of the trace starts here
230. 
231. 
232. static void
     ^
233. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
234. {

src/core/ngx_resolver.c:232:1: parameter `tree` of ngx_resolver_cleanup_tree
  230. 
  231. 
  232. static void
       ^
  233. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
  234. {

src/core/ngx_resolver.c:240:38: passed as argument to `ngx_rbtree_min`
  238.     while (tree->root != tree->sentinel) {
  239. 
  240.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  241. 
  242.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:240:38: return from call to `ngx_rbtree_min`
  238.     while (tree->root != tree->sentinel) {
  239. 
  240.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  241. 
  242.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:240:9: assigned
  238.     while (tree->root != tree->sentinel) {
  239. 
  240.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
               ^
  241. 
  242.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:256:9: when calling `ngx_resolver_free_node` here
  254.         ngx_rbtree_delete(tree, &rn->node);
  255. 
  256.         ngx_resolver_free_node(r, rn);
               ^
  257.     }
  258. }

src/core/ngx_resolver.c:2024:1: parameter `rn` of ngx_resolver_free_node
    2022. 
    2023. 
    2024. static void
          ^
    2025. ngx_resolver_free_node(ngx_resolver_t *r, ngx_resolver_node_t *rn)
    2026. {

src/core/ngx_resolver.c:2045:5: when calling `ngx_resolver_free_locked` here
    2043.     }
    2044. 
    2045.     ngx_resolver_free_locked(r, rn);
              ^
    2046. 
    2047.     /* unlock alloc mutex */

src/core/ngx_resolver.c:2092:1: parameter `p` of ngx_resolver_free_locked
      2090. 
      2091. 
      2092. static void
            ^
      2093. ngx_resolver_free_locked(ngx_resolver_t *r, void *p)
      2094. {

src/core/ngx_resolver.c:2095:5: was invalidated by call to `free()`
      2093. ngx_resolver_free_locked(ngx_resolver_t *r, void *p)
      2094. {
      2095.     ngx_free(p);
                ^
      2096. }
      2097. 

src/core/ngx_resolver.c:232:1: use-after-lifetime part of the trace starts here
230. 
231. 
232. static void
     ^
233. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
234. {

src/core/ngx_resolver.c:232:1: parameter `tree` of ngx_resolver_cleanup_tree
  230. 
  231. 
  232. static void
       ^
  233. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
  234. {

src/core/ngx_resolver.c:240:38: when calling `ngx_rbtree_min` here
  238.     while (tree->root != tree->sentinel) {
  239. 
  240.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  241. 
  242.         ngx_queue_remove(&rn->queue);

src/core/ngx_rbtree.h:73:1: parameter `node` of ngx_rbtree_min
    71. 
    72. 
    73. static ngx_inline ngx_rbtree_node_t *
        ^
    74. ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
    75. {

src/core/ngx_rbtree.h:76:12: invalid access occurs here
    74. ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
    75. {
    76.     while (node->left != sentinel) {
                   ^
    77.         node = node->left;
    78.     }

static ngx_inline ngx_rbtree_node_t *
ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
{
    while (node->left != sentinel) {
        node = node->left;
    }
    return node;
}
['static void\nngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)\n{\n    ngx_resolver_ctx_t   *ctx, *next;\n    ngx_resolver_node_t  *rn;\n    while (tree->root != tree->sentinel) {\n        rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);\n        ngx_queue_remove(&rn->queue);\n        for (ctx = rn->waiting; ctx; ctx = next) {\n            next = ctx->next;\n            if (ctx->event) {\n                ngx_resolver_free(r, ctx->event);\n            }\n            ngx_resolver_free(r, ctx);\n        }\n        ngx_rbtree_delete(tree, &rn->node);\n        ngx_resolver_free_node(r, rn);\n    }\n}', 'static void\nngx_resolver_free_node(ngx_resolver_t *r, ngx_resolver_node_t *rn)\n{\n    if (rn->query) {\n        ngx_resolver_free_locked(r, rn->query);\n    }\n    if (rn->name) {\n        ngx_resolver_free_locked(r, rn->name);\n    }\n    if (rn->cnlen) {\n        ngx_resolver_free_locked(r, rn->u.cname);\n    }\n    if (rn->naddrs > 1) {\n        ngx_resolver_free_locked(r, rn->u.addrs);\n    }\n    ngx_resolver_free_locked(r, rn);\n}', 'static void\nngx_resolver_free_locked(ngx_resolver_t *r, void *p)\n{\n    ngx_free(p);\n}', 'static ngx_inline ngx_rbtree_node_t *\nngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)\n{\n    while (node->left != sentinel) {\n        node = node->left;\n    }\n    return node;\n}']