bugfix: couldn't send two creates, two datas, and the destroy all at once

(amazing the odd behavior you get to test when you have a flaky modem
connection)

svn:r148

diff --git a/src/or/circuit.c b/src/or/circuit.c
index 49c09ba5d88983ae1c147478967ba676057cb4ba..9b8f36784c9c6b31d6fa4cd556cecc7e68507e0a 100644 (file)
--- a/src/or/circuit.c
+++ b/src/or/circuit.c
@@ -352,6 +352,7 @@ void circuit_about_to_close_connection(connection_t *conn) {
     circuit_remove(circ);
     if(circ->n_conn == conn) /* it's closing in front of us */
       /* circ->p_conn should always be set */
+      assert(circ->p_conn);
       connection_send_destroy(circ->p_aci, circ->p_conn);
     if(circ->p_conn == conn) /* it's closing behind us */
       if(circ->n_conn)

diff --git a/src/or/command.c b/src/or/command.c
index c725b22808382f8751f32d3538650820fa8cda1e..ab042c0609ed9742313483e8cebb74876c2aa284 100644 (file)
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -300,10 +300,14 @@ void command_process_destroy_cell(cell_t *cell, connection_t *conn) {
     onion_pending_remove(circ);
   }
   circuit_remove(circ);
-  if(cell->aci == circ->p_aci) /* the destroy came from behind */
-    connection_send_destroy(circ->n_aci, circ->n_conn);
-  if(cell->aci == circ->n_aci) /* the destroy came from ahead */
+  if(cell->aci == circ->p_aci) { /* the destroy came from behind */
+    if(circ->n_conn) /* might not be defined, eg if it was just on the pending queue */
+      connection_send_destroy(circ->n_aci, circ->n_conn);
+  }
+  if(cell->aci == circ->n_aci) { /* the destroy came from ahead */
+    assert(circ->p_conn);
     connection_send_destroy(circ->p_aci, circ->p_conn);
+  }
   circuit_free(circ);
 }