src/core/ngx_resolver.c:244: error: Use After Free
  call to `ngx_rbtree_min()` eventually accesses memory that was invalidated by call to `free()` on line 260 indirectly during the call to `ngx_resolver_free_node()`.

src/core/ngx_resolver.c:236:1: invalidation part of the trace starts here
234. 
235. 
236. static void
     ^
237. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
238. {

src/core/ngx_resolver.c:236:1: parameter `tree` of ngx_resolver_cleanup_tree
  234. 
  235. 
  236. static void
       ^
  237. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
  238. {

src/core/ngx_resolver.c:244:38: passed as argument to `ngx_rbtree_min`
  242.     while (tree->root != tree->sentinel) {
  243. 
  244.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  245. 
  246.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:244:38: return from call to `ngx_rbtree_min`
  242.     while (tree->root != tree->sentinel) {
  243. 
  244.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  245. 
  246.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:244:9: assigned
  242.     while (tree->root != tree->sentinel) {
  243. 
  244.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
               ^
  245. 
  246.         ngx_queue_remove(&rn->queue);

src/core/ngx_resolver.c:260:9: when calling `ngx_resolver_free_node` here
  258.         ngx_rbtree_delete(tree, &rn->node);
  259. 
  260.         ngx_resolver_free_node(r, rn);
               ^
  261.     }
  262. }

src/core/ngx_resolver.c:2027:1: parameter `rn` of ngx_resolver_free_node
    2025. 
    2026. 
    2027. static void
          ^
    2028. ngx_resolver_free_node(ngx_resolver_t *r, ngx_resolver_node_t *rn)
    2029. {

src/core/ngx_resolver.c:2048:5: when calling `ngx_resolver_free_locked` here
    2046.     }
    2047. 
    2048.     ngx_resolver_free_locked(r, rn);
              ^
    2049. 
    2050.     /* unlock alloc mutex */

src/core/ngx_resolver.c:2095:1: parameter `p` of ngx_resolver_free_locked
      2093. 
      2094. 
      2095. static void
            ^
      2096. ngx_resolver_free_locked(ngx_resolver_t *r, void *p)
      2097. {

src/core/ngx_resolver.c:2098:5: was invalidated by call to `free()`
      2096. ngx_resolver_free_locked(ngx_resolver_t *r, void *p)
      2097. {
      2098.     ngx_free(p);
                ^
      2099. }
      2100. 

src/core/ngx_resolver.c:236:1: use-after-lifetime part of the trace starts here
234. 
235. 
236. static void
     ^
237. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
238. {

src/core/ngx_resolver.c:236:1: parameter `tree` of ngx_resolver_cleanup_tree
  234. 
  235. 
  236. static void
       ^
  237. ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree)
  238. {

src/core/ngx_resolver.c:244:38: when calling `ngx_rbtree_min` here
  242.     while (tree->root != tree->sentinel) {
  243. 
  244.         rn = (ngx_resolver_node_t *) ngx_rbtree_min(tree->root, tree->sentinel);
                                            ^
  245. 
  246.         ngx_queue_remove(&rn->queue);

src/core/ngx_rbtree.h:72:1: parameter `node` of ngx_rbtree_min
    70. 
    71. 
    72. static ngx_inline ngx_rbtree_node_t *
        ^
    73. ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
    74. {

src/core/ngx_rbtree.h:75:12: invalid access occurs here
    73. ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
    74. {
    75.     while (node->left != sentinel) {
                   ^
    76.         node = node->left;
    77.     }
