rbtree.c: rb_fixup