finally tracked down the seg fault

svn:r455

src/or/connection.c

@@ -249,7 +249,7 @@ int connection_handle_listener_read(connection_t *conn, int new_type) {
   }
 
   if(connection_init_accepted_conn(newconn) < 0) {
-    connection_free(newconn);
+    newconn->marked_for_close = 1;
     return 0;
   }
   return 0;

src/or/main.c

@@ -676,6 +676,7 @@ build_directory(directory_t *dir) {
       continue; /* we only want to list ones that successfully handshaked */
     router = router_get_by_addr_port(conn->addr,conn->port);
     if(!router) {
+      /* XXX this legitimately happens when conn is an OP. How to detect this? */
       log(LOG_ERR,"build_directory(): couldn't find router %d:%d!",
           conn->addr,conn->port);
       continue;