Some *_free functions threw asserts when passed NULL. Now all of them
accept NULL as input and perform no action when called that way.

This gains us consistence for our free functions, and allows some
code simplifications where an explicit null check is no longer necessary.

In C, the code "char x[10]; if (x) {...}" always takes the true branch of
the if statement.  Coverity notices this now.

In some cases, we were testing arrays to make sure that an operation
we wanted to do would suceed.  Those cases are now always-true.

In some cases, we were testing arrays to see if something was _set_.
Those caes are now tests for strlen(s), or tests for
!tor_mem_is_zero(d,len).

backport of c43859c5
backport of 0d13e0ed

This was introduced in f7e6e852.
Found by Coverity

There were however other places where we used to call this
function that might have caused this to fire. Better
safe than sorry now.

This seems to be happening to me a lot on a garbage DSL line.
We may need to come up with 2 threshholds: a high short onehop
count and a lower longer count.

Pretimeouts may have build time data, just no timeout data.

Don't count one-hop circuits when we're estimating how long it
takes circuits to build on average. Otherwise we'll set our circuit
build timeout lower than we should. Bugfix on 0.2.2.2-alpha.

Mike Perry authored Sep 29, 2009 and Nick Mathewson committed Sep 29, 2009

1108 was actually just a fencepost error in an assert,
but making the state file handling code resilient is a
good idea.

Sebastian Hahn authored Sep 26, 2009 and Nick Mathewson committed Sep 27, 2009

Some memory could be lost in the error case of
circuit_build_times_parse_state.

Found by Coverity

Don't pass in a quantile that is too high during pretimeout
calcualtion.

Try to clarify things in the comment too.

A) We were considering a circuit had timed out in the special cases
where we close rendezvous circuits because the final rendezvous
circuit couldn't be built in time.
B) We were looking at the wrong timestamp_created when considering
a timeout.

Based on irc discussion with arma.

Mostly by storing the timeout as milliseconds and not seconds
internally.

And also the number of recent circuits used to decide
when the network changes.

We want it to be under our control so it doesn't mess
up initialization. This is likely the cause for
the bug the previous assert-adding commit (09a75ad3) was
trying to address.

Got a negative timeout value on startup. Need to narrow it down.

Also use bin midpoints for time values.

It seems to fire because of precision issues. Added
more debug info to the warn to try to figure out for sure.

Also change the max timeout quantile to 0.98, so we can
avoid huge synthetic timeout values.

Also correct some typos.

Using CircuitBuildTimeout is prone to issues with SIGHUP, etc.
Also, shuffle the circuit build times array after loading it
in so that newer measurements don't replace chunks of
similarly timed measurements.

Also switch Xm calculation to mode, not min.

It was compiling, but causing segfaults.

Also, adjust when the timer starts for new test circs
and save state every 25 circuits.

Also add code to keep creating circuits every minute until we
hit our minimum threshhold.