[tor-bugs] #18116 [Tor]: abort in circuitmux_detach_all_circuits on Tor Browser exit with stem scripts running

[Tor Bug Tracker & Wiki]

#18116: abort in circuitmux_detach_all_circuits on Tor Browser exit with stem
scripts running
-------------------------------------+------------------------------------
 Reporter:  teor                     |          Owner:  andrea
     Type:  defect                   |         Status:  assigned
 Priority:  Medium                   |      Milestone:  Tor: 0.2.8.x-final
Component:  Tor                      |        Version:
 Severity:  Normal                   |     Resolution:
 Keywords:  crash TorCoreTeam201602  |  Actual Points:
Parent ID:                           |         Points:
  Sponsor:                           |
-------------------------------------+------------------------------------

Comment (by teor):

 Replying to [comment:3 andrea]:
 > Is this reproducible?

 I'll have time to check this in a few days.

 > It sounds like something screwed up some cmux-internal data structures
 and it quite plausibly has the same cause as the line right above it:
 >
 > {{{
 > 00:12.000 [warn] Couldn't find circuit 2162585894 (for channel 599)
 > }}}
 >
 > To find the cause of this, it'd be most helpful to figure out exactly
 where that warning came from; I suspect something destroyed a circuit
 without telling cmux about it.

 I'll have time to find where the log message is coming from in a few more
 days.

 > IIRC I had to fix a few like this while writing cmux by finding
 everywhere we were doing anything like that and making sure they went
 through proper interfaces - perhaps something new was introduced recently
 that doesn't do that?

 Tor's implementation of the controller CLOSECIRCUIT command is a possible
 culprit here.

 Alternately, it could be that when I create the circuit in the controller,
 I mark it as `purpose = "controller"`, and it's these open circuits that
 are causing issues when I quit tor.

 Otherwise, periodic events have been refactored in master (9f31908a), and
 attach_circuit has been decoupled (#17590), and I've had code merged that
 closes circuits, but I believe it does it through the proper interfaces
 (#4483).

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18116#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online