fix use-after-free in rbtree