bugfix: couldn't send two creates, two datas, and the destroy all at once

(amazing the odd behavior you get to test when you have a flaky modem
connection)


svn:r148

2 files changed, 8 insertions, 3 deletions

diff --git a/src/or/circuit.c b/src/or/circuit.c
index 49c09ba5d..9b8f36784 100644
--- a/src/or/circuit.c
+++ b/src/or/circuit.c
@@ -352,6 +352,7 @@ void circuit_about_to_close_connection(connection_t *conn) {
     circuit_remove(circ);
     if(circ->n_conn == conn) /* it's closing in front of us */
       /* circ->p_conn should always be set */
+      assert(circ->p_conn);
       connection_send_destroy(circ->p_aci, circ->p_conn);
     if(circ->p_conn == conn) /* it's closing behind us */
       if(circ->n_conn)
diff --git a/src/or/command.c b/src/or/command.c
index c725b2280..ab042c060 100644
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -300,10 +300,14 @@ void command_process_destroy_cell(cell_t *cell, connection_t *conn) {
     onion_pending_remove(circ);
   }
   circuit_remove(circ);
-  if(cell->aci == circ->p_aci) /* the destroy came from behind */
-    connection_send_destroy(circ->n_aci, circ->n_conn);
-  if(cell->aci == circ->n_aci) /* the destroy came from ahead */
+  if(cell->aci == circ->p_aci) { /* the destroy came from behind */
+    if(circ->n_conn) /* might not be defined, eg if it was just on the pending queue */
+      connection_send_destroy(circ->n_aci, circ->n_conn);
+  }
+  if(cell->aci == circ->n_aci) { /* the destroy came from ahead */
+    assert(circ->p_conn);
     connection_send_destroy(circ->p_aci, circ->p_conn);
+  }
   circuit_free(circ);
 }