src/core/ngx_resolver.c:291: error: Use After Free
  call to `ngx_rbtree_min()` eventually accesses memory that was invalidated by call to `free()` on line 307 indirectly during the call to `ngx_resolver_free_node()`.

src/core/ngx_resolver.c:283:1: invalidation part of the trace starts here
281. 
282. 
283. static void
     ^
284. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
285. {

src/core/ngx_resolver.c:283:1: parameter `tree` of ngx_resolver_cleanup_tree
  281. 
  282. 
  283. static void
       ^
  284. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
  285. {

src/core/ngx_resolver.c:291:38: passed as argument to `ngx_rbtree_min`
  289.     while (tree->root != tree->sentinel) {
  290. 
  291.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  292. 
  293.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:291:38: return from call to `ngx_rbtree_min`
  289.     while (tree->root != tree->sentinel) {
  290. 
  291.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  292. 
  293.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:291:9: assigned
  289.     while (tree->root != tree->sentinel) {
  290. 
  291.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
               ^
  292. 
  293.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:307:9: when calling `ngx_resolver_free_node` here
  305.         ngx_rbtree_delete(tree, &rn->node);
  306. 
  307.         ngx_resolver_free_node(r, rn);
               ^
  308.     }
  309. }

src/core/ngx_resolver.c:2811:1: parameter `rn` of ngx_resolver_free_node
    2809. 
    2810. 
    2811. static void
          ^
    2812. ngx_resolver_free_node(ngx_resolver_t *r, ngx_resolver_node_t *rn)
    2813. {

src/core/ngx_resolver.c:2838:5: when calling `ngx_resolver_free_locked` here
    2836. #endif
    2837. 
    2838.     ngx_resolver_free_locked(r, rn);
              ^
    2839. 
    2840.     /* unlock alloc mutex */

src/core/ngx_resolver.c:2885:1: parameter `p` of ngx_resolver_free_locked
      2883. 
      2884. 
      2885. static void
            ^
      2886. ngx_resolver_free_locked(ngx_resolver_t *r, void *p)
      2887. {

src/core/ngx_resolver.c:2888:5: was invalidated by call to `free()`
      2886. ngx_resolver_free_locked(ngx_resolver_t *r, void *p)
      2887. {
      2888.     ngx_free(p);
                ^
      2889. }
      2890. 

src/core/ngx_resolver.c:283:1: use-after-lifetime part of the trace starts here
281. 
282. 
283. static void
     ^
284. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
285. {

src/core/ngx_resolver.c:283:1: parameter `tree` of ngx_resolver_cleanup_tree
  281. 
  282. 
  283. static void
       ^
  284. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
  285. {

src/core/ngx_resolver.c:291:38: when calling `ngx_rbtree_min` here
  289.     while (tree->root != tree->sentinel) {
  290. 
  291.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  292. 
  293.         ngx_queue_remove(&rn->queue);

src/core/ngx_rbtree.h:71:1: parameter `node` of ngx_rbtree_min
    69. 
    70. 
    71. static ngx_inline ngx_rbtree_node_t *
        ^
    72. ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
    73. {

src/core/ngx_rbtree.h:74:12: invalid access occurs here
    72. ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
    73. {
    74.     while (node->left != sentinel) {
                   ^
    75.         node = node->left;
    76.     }

static ngx_inline ngx_rbtree_node_t *
ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
{
    while (node->left != sentinel) {
        node = node->left;
    }
    return node;
}
['static void\nngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)\n{\n    ngx_resolver_ctx_t   *ctx, *next;\n    ngx_resolver_node_t  *rn;\n    while (tree->root != tree->sentinel) {\n        rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);\n        ngx_queue_remove(&rn->queue);\n        for (ctx = rn->waiting; ctx; ctx = next) {\n            next = ctx->next;\n            if (ctx->event) {\n                ngx_resolver_free(r, ctx->event);\n            }\n            ngx_resolver_free(r, ctx);\n        }\n        ngx_rbtree_delete(tree, &rn->node);\n        ngx_resolver_free_node(r, rn);\n    }\n}', 'static void\nngx_resolver_free_node(ngx_resolver_t *r, ngx_resolver_node_t *rn)\n{\n    if (rn->query) {\n        ngx_resolver_free_locked(r, rn->query);\n    }\n    if (rn->name) {\n        ngx_resolver_free_locked(r, rn->name);\n    }\n    if (rn->cnlen) {\n        ngx_resolver_free_locked(r, rn->u.cname);\n    }\n    if (rn->naddrs > 1 && rn->naddrs != (u_short) -1) {\n        ngx_resolver_free_locked(r, rn->u.addrs);\n    }\n#if (NGX_HAVE_INET6)\n    if (rn->naddrs6 > 1 && rn->naddrs6 != (u_short) -1) {\n        ngx_resolver_free_locked(r, rn->u6.addrs6);\n    }\n#endif\n    ngx_resolver_free_locked(r, rn);\n}', 'static void\nngx_resolver_free_locked(ngx_resolver_t *r, void *p)\n{\n    ngx_free(p);\n}', 'static ngx_inline ngx_rbtree_node_t *\nngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)\n{\n    while (node->left != sentinel) {\n        node = node->left;\n    }\n    return node;\n}']