Possible race closing bad_for_new_circs channels, others
Skruffy on IRC reports this bug.
Suppose that we have a channel to a router that we don't want to use for new circuits, and we're opening a new channel, and we have some pending circuits.
When we call channel_closed() on the first channel (which should have bad_for_new_circs set on it), it will call circuit_n_chan_done(chan, 0), which will kill all the circuits pending on the second channel.
One option here is to call circuit_n_chan_done(chan, 0) only if the channel was not open.
Another (possibly) is to change circuit_get_all_pending_on_channel so that no circuit can be pending on a bad_for_new_circs channel.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information