New bug class: Accessing rend_data/hs_ident after marking for close a circuit
See legacy/trac#30771 (moved) for an example of this issue:
circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_FINISHED);
/* close any other intros launched in parallel */
rend_client_close_other_intros(rend_data_get_pk_digest(circ->rend_data,
NULL));
It seems to be caused by a bad interaction between legacy/trac#29034 (moved) and legacy/trac#28780 (moved), plus some naughty v2 code. The v2 code marks the circuit as closed and then tries to access rend_data out of it, but because of legacy/trac#28780 (moved) the mark for close repurposes the circuit to a padding circuit instead, and then because legacy/trac#29034 (moved) we also clean its rend_data. This causes the crash.
We should make sure that this pattern is impossible in other parts of the code, so that we don't assert out again, or even worse access freed memory.