May trigger coredump when ngx_http_set_builtin_multi_header and subrequest？

[haiyyang]

1 ngx_http_set_builtin_multi_header will destroy and reinit multi header array in the main request, but the header address is reserved in header variable of the subrequest 2 if ngx_array_destroy really release the memory and reuse by other logic， then subrequest access the headers may cause error