src/ngx_http_lua_timer.c: null pointer dereference suspected by coverity

275    p = ngx_alloc(sizeof(ngx_event_t) + sizeof(ngx_http_lua_timer_ctx_t),
   deref_ptr: Directly dereferencing pointer r->connection.
276                  r->connection->log);
277    if (p == NULL) {
278        goto nomem;
279    }
280
281    ev = (ngx_event_t *) p;
282
283    ngx_memzero(ev, sizeof(ngx_event_t));
284
285    p += sizeof(ngx_event_t);
286
287    tctx = (ngx_http_lua_timer_ctx_t *) p;
288
289    tctx->delay = every ? delay : 0;
290
291    tctx->premature = 0;
292    tctx->co_ref = co_ref;
293    tctx->co = co;
294    tctx->main_conf = r->main_conf;
295    tctx->srv_conf = r->srv_conf;
296    tctx->loc_conf = r->loc_conf;
297    tctx->lmcf = lmcf;
298
299    tctx->pool = ngx_create_pool(128, ngx_cycle->log);
300    if (tctx->pool == NULL) {
301        goto nomem;
302    }
303
   CID 251616 (#1 of 1): Dereference before null check (REVERSE_INULL)check_after_deref: Null-checking r->connection suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
304    if (r->connection) {
305        tctx->listening = r->connection->listening;
306
307    } else {
308        tctx->listening = NULL;
309    }

Start in src/ngx_http_lua_timer.c around lines 275-308 and trace how r->connection is used before the later null check. Confirm the Coverity report and inspect the surrounding timer setup to determine the intended handling. Done means the reported null-dereference warning is resolved and the timer path still handles the shown cases correctly.