Merge remote-tracking branch 'public/bug12848_024' into maint-0.2.5

Conflicts:
	src/or/circuitbuild.c

diff --cc src/or/channel.c
index 3072effc8f285d7c9174b31fb49a952b3fb03eea,cd55bd0dfd6e8e1210897c60c016a7dd739c9d3b..ffd68493d0bbee8414c80818d71e08c4ace699e7
--- 1/src/or/channel.c
--- 2/src/or/channel.c
+++ b/src/or/channel.c
@@@ -2681,7 -2622,17 +2681,15 @@@ is_destroy_cell(channel_t *chan
  int
  channel_send_destroy(circid_t circ_id, channel_t *chan, int reason)
  {
 -  cell_t cell;
 -
    tor_assert(chan);
+   if (circ_id == 0) {
+     log_warn(LD_BUG, "Attempted to send a destroy cell for circID 0 "
+              "on a channel " U64_FORMAT " at %p in state %s (%d)",
+              U64_PRINTF_ARG(chan->global_identifier),
+              chan, channel_state_to_string(chan->state),
+              chan->state);
+     return 0;
+   }
  
    /* Check to make sure we can send on this channel first */
    if (!(chan->state == CHANNEL_STATE_CLOSING ||

diff --cc src/or/circuitbuild.c
index 283afee31fcdfe298cfa9fc9b83d158b02503322,5325eff64ae2cee314cd81c6f66e4078019be513..897f90fe4c7160abab96f5af74d6d5310709baba
--- 1/src/or/circuitbuild.c
--- 2/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@@ -657,13 -584,9 +658,11 @@@ circuit_deliver_create_cell(circuit_t *
  
    id = get_unique_circ_id_by_chan(circ->n_chan);
    if (!id) {
 -    log_warn(LD_CIRC,"failed to get unique circID.");
 +    static ratelim_t circid_warning_limit = RATELIM_INIT(9600);
 +    log_fn_ratelim(&circid_warning_limit, LOG_WARN, LD_CIRC,
 +                   "failed to get unique circID.");
-     return -1;
+     goto error;
    }
-   log_debug(LD_CIRC,"Chosen circID %u.", (unsigned)id);
-   circuit_set_n_circid_chan(circ, id, circ->n_chan);
  
    memset(&cell, 0, sizeof(cell_t));
    r = relayed ? create_cell_format_relayed(&cell, create_cell)