solution 2 for recover BST

Morris traversal