Fixed crash in ngx_resolver_cleanup_tree(). If sending a DNS request fails with an error (e.g., when mistakenly trying to send it to a local IP broadcast), such a request is not deleted if there are clients waiting on it. However, it was still erroneously removed from the queue. Later ngx_resolver_cleanup_tree() attempted to remove it from the queue again that resulted in a NULL pointer dereference.