Is there a bug in ngx_http_upstream_module's broken connection check code?

[speedfirst]

So will it trigger a bug like this?
1. client access nginx via https
2. nginx proxy pass the request to upstream
3. before upstream response, client close the connection, then dispose
current ngx_http_request_t object and its memory pool
4. upstream sends back the response and invoke the read handler
5. the handler uses a disposed ngx_http_request_t object, and segment
fault.

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,209276,209548#msg-209548