src/core/ngx_resolver.c:245: error: Use After Free
  call to `ngx_rbtree_min()` eventually accesses memory that was invalidated by call to `free()` on line 261 indirectly during the call to `ngx_resolver_free_node()`.

src/core/ngx_resolver.c:237:1: invalidation part of the trace starts here
235. 
236. 
237. static void
     ^
238. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
239. {

src/core/ngx_resolver.c:237:1: parameter `tree` of ngx_resolver_cleanup_tree
  235. 
  236. 
  237. static void
       ^
  238. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
  239. {

src/core/ngx_resolver.c:245:38: passed as argument to `ngx_rbtree_min`
  243.     while (tree->root != tree->sentinel) {
  244. 
  245.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  246. 
  247.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:245:38: return from call to `ngx_rbtree_min`
  243.     while (tree->root != tree->sentinel) {
  244. 
  245.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  246. 
  247.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:245:9: assigned
  243.     while (tree->root != tree->sentinel) {
  244. 
  245.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
               ^
  246. 
  247.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:261:9: when calling `ngx_resolver_free_node` here
  259.         ngx_rbtree_delete(tree, &rn->node);
  260. 
  261.         ngx_resolver_free_node(r, rn);
               ^
  262.     }
  263. }

src/core/ngx_resolver.c:2028:1: parameter `rn` of ngx_resolver_free_node
    2026. 
    2027. 
    2028. static void
          ^
    2029. ngx_resolver_free_node(ngx_resolver_t *r, ngx_resolver_node_t *rn)
    2030. {

src/core/ngx_resolver.c:2049:5: when calling `ngx_resolver_free_locked` here
    2047.     }
    2048. 
    2049.     ngx_resolver_free_locked(r, rn);
              ^
    2050. 
    2051.     /* unlock alloc mutex */

src/core/ngx_resolver.c:2096:1: parameter `p` of ngx_resolver_free_locked
      2094. 
      2095. 
      2096. static void
            ^
      2097. ngx_resolver_free_locked(ngx_resolver_t *r, void *p)
      2098. {

src/core/ngx_resolver.c:2099:5: was invalidated by call to `free()`
      2097. ngx_resolver_free_locked(ngx_resolver_t *r, void *p)
      2098. {
      2099.     ngx_free(p);
                ^
      2100. }
      2101. 

src/core/ngx_resolver.c:237:1: use-after-lifetime part of the trace starts here
235. 
236. 
237. static void
     ^
238. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
239. {

src/core/ngx_resolver.c:237:1: parameter `tree` of ngx_resolver_cleanup_tree
  235. 
  236. 
  237. static void
       ^
  238. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
  239. {

src/core/ngx_resolver.c:245:38: when calling `ngx_rbtree_min` here
  243.     while (tree->root != tree->sentinel) {
  244. 
  245.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  246. 
  247.         ngx_queue_remove(&rn->queue);

src/core/ngx_rbtree.h:73:1: parameter `node` of ngx_rbtree_min
    71. 
    72. 
    73. static ngx_inline ngx_rbtree_node_t *
        ^
    74. ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
    75. {

src/core/ngx_rbtree.h:76:12: invalid access occurs here
    74. ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
    75. {
    76.     while (node->left != sentinel) {
                   ^
    77.         node = node->left;
    78.     }

static ngx_inline ngx_rbtree_node_t *
ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
{
    while (node->left != sentinel) {
        node = node->left;
    }
    return node;
}
['static void\nngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)\n{\n    ngx_resolver_ctx_t   *ctx, *next;\n    ngx_resolver_node_t  *rn;\n    while (tree->root != tree->sentinel) {\n        rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);\n        ngx_queue_remove(&rn->queue);\n        for (ctx = rn->waiting; ctx; ctx = next) {\n            next = ctx->next;\n            if (ctx->event) {\n                ngx_resolver_free(r, ctx->event);\n            }\n            ngx_resolver_free(r, ctx);\n        }\n        ngx_rbtree_delete(tree, &rn->node);\n        ngx_resolver_free_node(r, rn);\n    }\n}', 'static void\nngx_resolver_free_node(ngx_resolver_t *r, ngx_resolver_node_t *rn)\n{\n    if (rn->query) {\n        ngx_resolver_free_locked(r, rn->query);\n    }\n    if (rn->name) {\n        ngx_resolver_free_locked(r, rn->name);\n    }\n    if (rn->cnlen) {\n        ngx_resolver_free_locked(r, rn->u.cname);\n    }\n    if (rn->naddrs > 1) {\n        ngx_resolver_free_locked(r, rn->u.addrs);\n    }\n    ngx_resolver_free_locked(r, rn);\n}', 'static void\nngx_resolver_free_locked(ngx_resolver_t *r, void *p)\n{\n    ngx_free(p);\n}', 'static ngx_inline ngx_rbtree_node_t *\nngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)\n{\n    while (node->left != sentinel) {\n        node = node->left;\n    }\n    return node;\n}']