src/core/ngx_resolver.c:200: error: Use After Free
  call to `ngx_rbtree_min()` eventually accesses memory that was invalidated by call to `free()` on line 216 indirectly during the call to `ngx_resolver_free_node()`.

src/core/ngx_resolver.c:192:1: invalidation part of the trace starts here
190. 
191. 
192. static void
     ^
193. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
194. {

src/core/ngx_resolver.c:192:1: parameter `tree` of ngx_resolver_cleanup_tree
  190. 
  191. 
  192. static void
       ^
  193. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
  194. {

src/core/ngx_resolver.c:200:38: passed as argument to `ngx_rbtree_min`
  198.     while (tree->root != tree->sentinel) {
  199. 
  200.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  201. 
  202.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:200:38: return from call to `ngx_rbtree_min`
  198.     while (tree->root != tree->sentinel) {
  199. 
  200.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  201. 
  202.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:200:9: assigned
  198.     while (tree->root != tree->sentinel) {
  199. 
  200.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
               ^
  201. 
  202.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:216:9: when calling `ngx_resolver_free_node` here
  214.         ngx_rbtree_delete(tree, &rn->node);
  215. 
  216.         ngx_resolver_free_node(r, rn);
               ^
  217.     }
  218. }

src/core/ngx_resolver.c:1954:1: parameter `rn` of ngx_resolver_free_node
    1952. 
    1953. 
    1954. static void
          ^
    1955. ngx_resolver_free_node(ngx_resolver_t *r, ngx_resolver_node_t *rn)
    1956. {

src/core/ngx_resolver.c:1975:5: when calling `ngx_resolver_free_locked` here
    1973.     }
    1974. 
    1975.     ngx_resolver_free_locked(r, rn);
              ^
    1976. 
    1977.     /* unlock alloc mutex */

src/core/ngx_resolver.c:2022:1: parameter `p` of ngx_resolver_free_locked
      2020. 
      2021. 
      2022. static void
            ^
      2023. ngx_resolver_free_locked(ngx_resolver_t *r, void *p)
      2024. {

src/core/ngx_resolver.c:2025:5: was invalidated by call to `free()`
      2023. ngx_resolver_free_locked(ngx_resolver_t *r, void *p)
      2024. {
      2025.     ngx_free(p);
                ^
      2026. }
      2027. 

src/core/ngx_resolver.c:192:1: use-after-lifetime part of the trace starts here
190. 
191. 
192. static void
     ^
193. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
194. {

src/core/ngx_resolver.c:192:1: parameter `tree` of ngx_resolver_cleanup_tree
  190. 
  191. 
  192. static void
       ^
  193. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
  194. {

src/core/ngx_resolver.c:200:38: when calling `ngx_rbtree_min` here
  198.     while (tree->root != tree->sentinel) {
  199. 
  200.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  201. 
  202.         ngx_queue_remove(&rn->queue);

src/core/ngx_rbtree.h:72:1: parameter `node` of ngx_rbtree_min
    70. 
    71. 
    72. static ngx_inline ngx_rbtree_node_t *
        ^
    73. ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
    74. {

src/core/ngx_rbtree.h:75:12: invalid access occurs here
    73. ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
    74. {
    75.     while (node->left != sentinel) {
                   ^
    76.         node = node->left;
    77.     }
