Bug #45205 fresh mysql installation dies on simple select
Submitted: 30 May 2009 13:23 Modified: 13 Jul 2009 8:18
Reporter: Adam Golebiowski Email Updates:
Status: Can't repeat Impact on me:
None 
Category:MySQL Server Severity:S1 (Critical)
Version:5.1.34 OS:Linux (PLD Linux)
Assigned to: CPU Architecture:Any

[30 May 2009 13:23] Adam Golebiowski
Description:
Mysql dies on simple select, seems like an issue with permissions:

The following query causes segfault:
echo 'SELECT * FROM mailboxes;' | mysql -u poczta --password=poczta poczta

The following does not (mysql user is mysql admin):
echo 'SELECT * FROM mailboxes;' | mysql -u mysql --password=newpassword poczta

How to repeat:
[root@angua mysql]# service mysql stop
Stopping MySQL /var/lib/mysql service...............................................................................................................................[ DONE ]
[root@angua mysql]# rm /var/log/mysql/* /var/lib/mysql/mysqldb -rf
[root@angua mysql]# service mysql init                             
Initializing cluster /var/lib/mysql.................................................................................................................................
Installing MySQL system tables for /var/lib/mysql/mysqldb/db........................................................................................................[ DONE ]

PLEASE REMEMBER TO SET A PASSWORD FOR THE MySQL USERS!
This is done, after starting database, in the order shown,
with:

For 'mysql_sysadmin' (RELOAD and SHUTDOWN privileges):
echo "update mysql.user set password=password('newpassword') where user='mysql_sysadmin'; FLUSH PRIVILEGES;" | mysql -u mysql -S /var/lib/mysql/mysqldb/mysql.sock

For 'mysql' user (ALL privileges, DB admin):
echo "update mysql.user set password=password('newpassword') where user='mysql'; FLUSH PRIVILEGES;" | mysql -u mysql -S /var/lib/mysql/mysqldb/mysql.sock

NOTE: mysql_sysadmin password should be placed to /var/lib/mysql/mysqld.conf in
mysqladmin section. See the manual for more instructions.
(This user is used at logs rotation and server shutdown)

Filling help tables.................................................................................................................................................[ DONE ]
[root@angua mysql]# service mysql start
Starting MySQL /var/lib/mysql service...............................................................................................................................[ DONE ]
_sysadmin'; FLUSH PRIVILEGES;" | mysql -u mysql -S /var/lib/mysql/mysqldb/mysql.sock                                                                                           <
[root@angua mysql]# echo "update mysql.user set password=password('newpassword') where user='mysql'; FLUSH PRIVILEGES;" | mysql -u mysql -S /var/lib/mysql/mysqldb/mysql.sock
[root@angua mysql]# mysqladmin -u mysql --password=newpassword create poczta         
[root@angua mysql]# echo "grant all privileges on poczta.* to poczta@localhost identified by 'poczta'; FLUSH PRIVILEGES;" | mysql -u mysql --password=mysql mysql
[root@angua mysql]# cat /tmp/poczta.dump
CREATE TABLE `exim_greylist` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `relay_ip` varchar(64) DEFAULT NULL,
  `from_domain` varchar(255) DEFAULT NULL,
  `block_expires` datetime NOT NULL,
  `record_expires` datetime NOT NULL,
  `origin_type` enum('MANUAL','AUTO') NOT NULL DEFAULT 'AUTO',
  `create_time` datetime NOT NULL,
  PRIMARY KEY (`id`)
);

CREATE TABLE `mailboxes` (
  `domain` varchar(255) NOT NULL DEFAULT '',
  `username` varchar(255) NOT NULL DEFAULT '',
  `passwd` varchar(255) NOT NULL DEFAULT '',
  `alias` varchar(255) NOT NULL DEFAULT '',
  `remove_spam` tinyint(4) NOT NULL DEFAULT '0',
  `move_to_spam_folder` tinyint(4) NOT NULL DEFAULT '0',
  `do_not_mark_spam` tinyint(4) NOT NULL DEFAULT '0'
);

INSERT INTO `mailboxes` VALUES ('example.com','adamg','9dd4e461268c8034f5c8564e155c67a6','',0,0,0);
[root@angua mysql]# mysql -u poczta --password=poczta poczta < /tmp/poczta.dump
[root@angua mysql]# echo 'SELECT * FROM mailboxes;' | mysql -u poczta --password=poczta poczta
ERROR 2013 (HY000) at line 1: Lost connection to MySQL server during query
[root@angua mysql]# cat /var/log/mysql/mysqld.log
InnoDB: The first specified data file /var/lib/mysql/mysqldb/db/ibdata1 did not exist:
InnoDB: a new database to be created!
090530 17:03:17  InnoDB: Setting file /var/lib/mysql/mysqldb/db/ibdata1 size to 10 MB
InnoDB: Database physically writes the file full: wait...
090530 17:03:17  InnoDB: Log file /var/lib/mysql/mysqldb/db/ib_logfile0 did not exist: new to be created
InnoDB: Setting log file /var/lib/mysql/mysqldb/db/ib_logfile0 size to 5 MB
InnoDB: Database physically writes the file full: wait...
090530 17:03:17  InnoDB: Log file /var/lib/mysql/mysqldb/db/ib_logfile1 did not exist: new to be created
InnoDB: Setting log file /var/lib/mysql/mysqldb/db/ib_logfile1 size to 5 MB
InnoDB: Database physically writes the file full: wait...
InnoDB: Doublewrite buffer not found: creating new
InnoDB: Doublewrite buffer created
InnoDB: Creating foreign key constraint system tables
InnoDB: Foreign key constraint system tables created
090530 17:03:17  InnoDB: Started; log sequence number 0 0
090530 17:03:17  InnoDB: Starting shutdown...
090530 17:03:19  InnoDB: Shutdown completed; log sequence number 0 46409
090530 17:03:19 [Warning] Forcing shutdown of 1 plugins
090530 17:03:19  InnoDB: Started; log sequence number 0 46409
090530 17:03:19  InnoDB: Starting shutdown...
090530 17:03:20  InnoDB: Shutdown completed; log sequence number 0 46409
090530 17:03:20 [Warning] Forcing shutdown of 1 plugins
090530 17:03:24  InnoDB: Started; log sequence number 0 46409
090530 17:03:24 [Note] Event Scheduler: Loaded 0 events
090530 17:03:24 [Note] /usr/sbin/mysqld: ready for connections.
Version: '5.1.34-log'  socket: '/var/lib/mysql/mysqldb/mysql.sock'  port: 0  PLD Linux Distribution MySQL RPM
090530 17:05:47 - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.

key_buffer_size=8384512
read_buffer_size=131072
max_used_connections=1
max_threads=151
threads_connected=1
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 337743 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

thd: 0x8b1a0b8
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0xb489936c thread_stack 0x30000
/usr/sbin/mysqld(my_print_stacktrace+0x29) [0x8478b3f]
/usr/sbin/mysqld(handle_segfault+0x4bd) [0x81cf450]
[0xb80a4400]
/usr/sbin/mysqld(QUERY_PROFILE::new_status(char const*, char const*, char const*, unsigned int)+0x68) [0x825151a]
/usr/sbin/mysqld(PROFILING::status_change(char const*, char const*, char const*, unsigned int)+0x51) [0x82515dd]
/usr/sbin/mysqld(set_thd_proc_info+0x4a) [0x81be46b]
/usr/sbin/mysqld(check_access(THD*, unsigned long, char const*, unsigned long*, bool, bool, bool)+0x92) [0x81d8382]
/usr/sbin/mysqld(check_table_access(THD*, unsigned long, TABLE_LIST*, unsigned int, bool)+0x206) [0x81d8d2c]
/usr/sbin/mysqld(mysql_execute_command(THD*)+0x59e) [0x81dc75b]
/usr/sbin/mysqld(mysql_parse(THD*, char const*, unsigned int, char const**)+0x2f1) [0x81e3cbf]
/usr/sbin/mysqld(dispatch_command(enum_server_command, THD*, char*, unsigned int)+0xdcc) [0x81e4f7e]
/usr/sbin/mysqld(do_command(THD*)+0xf5) [0x81e589d]
/usr/sbin/mysqld(handle_one_connection+0x32a) [0x81d6003]
/lib/libpthread.so.0 [0xb8088522]
/lib/libpthread.so.0 [0xb808843d]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at 0x8b6a360 = SELECT * FROM mailboxes
thd->thread_id=6
thd->killed=NOT_KILLED
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.
[root@angua mysql]#
[31 May 2009 0:19] Sveta Smirnova
Thank you for the report.

I can not repeat described behavior. Does file ' /tmp/poczta.dump' contain additional data?
[31 May 2009 9:23] Adam Golebiowski
simple sql dump

Attachment: poczta.dump (application/octet-stream, text), 822 bytes.

[31 May 2009 9:24] Adam Golebiowski
No it doesn't (see attached file). I believe there may be problem with permissions at some point, since the query works perfectly when I log in with mysql "root" user (here it is called 'mysql').
[1 Jun 2009 7:13] Sveta Smirnova
Thank you for the feedback.

Please indicate accurate MySQL package name you use (filename which you downloaded) and provide your configuration file.
[1 Jun 2009 8:34] Adam Golebiowski
mysqld.conf

Attachment: mysqld.conf (application/octet-stream, text), 5.62 KiB.

[1 Jun 2009 8:36] Adam Golebiowski
I've attached mysqld.conf. 
Mysql comes from RPM packages distributed with PLD Linux.
[1 Jun 2009 8:42] Sveta Smirnova
Thank you for the feedback.

Could you also please try version available from http://dev.mysql.com/downloads in your environment to be sure this is not PLD package problem?
[8 Jun 2009 17:06] Adam Golebiowski
For what its worth, an upgrade to 5.1.35 solves this issue. Let me know if you want me to perform some additional tests. If not, we can close this bug.
[8 Jun 2009 17:37] Sveta Smirnova
Thank you for the feedback.

Closed as "Can't repeat" because last comment. Feel free to reopen the report if you meet this again.
[22 Jun 2009 19:02] Arkadiusz Miskiewicz
I'm able to repeat it reliably only on i686 (x86_64 works fine). I use the same distro/mysql as Adam.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xf6ce6b70 (LWP 227820)]       
QUERY_PROFILE::new_status (this=0xb60f0000, status_arg=0x84a8b6a "checking permissions", function_arg=0x84a93cc "check_access",
    file_arg=0x84a8b5d "sql_parse.cc", line_arg=5158) at sql_profile.cc:276
276       profile_end= prof;
(gdb) where
#0  QUERY_PROFILE::new_status (this=0xb60f0000, status_arg=0x84a8b6a "checking permissions", function_arg=0x84a93cc "check_access",
    file_arg=0x84a8b5d "sql_parse.cc", line_arg=5158) at sql_profile.cc:276
#1  0x0824f89d in PROFILING::status_change (this=0x81be8f5, status_arg=0xd <Address 0xd out of bounds>, function_arg=0x84a93cc "check_access",
    file_arg=0x84a8b5d "sql_parse.cc", line_arg=5158) at sql_profile.cc:320
#2  0x081bd94d in set_thd_proc_info (thd=0x81bd94d, info=0x84a8b6a "checking permissions", calling_function=0x84a93cc "check_access",
    calling_file=0x84a8b5d "sql_parse.cc", calling_line=5158) at sql_class.cc:273
#3  0x081d75ca in check_access (thd=0x81bd94d, want_access=1,
    db=0x86a4ff4 "\30(j\b`\226\232J\220\362\231J\366\274\21\b \36\264J\374\363\263J&\275\21\b6\275\21\bF\275\21\b\200\37\247J\260%\264Jv\275\21\b\206\275\21\b 6\371\367\246\275\21\b\266\275\21\b\304\356\263J\21\b\346\275\21\b\330\v\241J\6\276\21\b\26\276\21\b0K\244J[\354\263JF\276\21\bV\276\21\b0\273\247J#Z\264J\206\276\21\b\252\326\377J\246\276\21\b\266\276\21\b\20\252\246J\360M\264J\346\276\21\b\354J\6\277\21\b\26\277\21\b&\277\21\b\200\326\377JF\277\21\bV\277\21\bf\277\21\bv\277\21\b\220\272\247J\226\277\21\b\246\277\21\b\4%\264Jƿ\21\b\210\354\263J"..., save_priv=0x8b0bcac, dont_check_global_grants=false,
    no_errors=false, schema_db=false) at sql_parse.cc:5158
#4  0x081d7f74 in check_table_access (thd=0x8adc7b0, want_access=1, tables=0x8b0bb88, number=4294967295, no_errors=<value optimized out>)
    at sql_parse.cc:5387
#5  0x081db1e3 in mysql_execute_command (thd=0x8adc7b0) at sql_parse.cc:2197
#6  0x081e2823 in mysql_parse (thd=0x8adc7b0, inBuf=0x8b0ba60 "select * from x", length=15, found_semicolon=0xf6ce62bc) at sql_parse.cc:5929
#7  0x081e3ade in dispatch_command (command=COM_QUERY, thd=0x8adc7b0, packet=0x8b00a29 "select * from x", packet_length=15) at sql_parse.cc:1216
#8  0x081e43fd in do_command (thd=0x8adc7b0) at sql_parse.cc:857
#9  0x081d5246 in handle_one_connection (arg=0x8adc7b0) at sql_connect.cc:1115
#10 0x4ab3d522 in start_thread (arg=0x0) at pthread_create.c:297
#11 0x4ab3d43d in __free_tcb (pd=<value optimized out>) at pthread_create.c:216
#12 0x00000000 in ?? ()
(gdb) l
271       if ((function_arg != NULL) && (file_arg != NULL))
272         prof= new PROF_MEASUREMENT(this, status_arg, function_arg, file_arg, line_arg);
273       else
274         prof= new PROF_MEASUREMENT(this, status_arg);
275
276       profile_end= prof;
277       entries.push_back(prof);
278
279       DBUG_VOID_RETURN;
280     }
(gdb) print profile_end
Cannot access memory at address 0xb60f0014
(gdb)
[23 Jun 2009 7:08] Sveta Smirnova
Arkadiusz,

do you mean 5.1.34 or 5.1.35 distro?
[6 Jul 2009 20:20] Arkadiusz Miskiewicz
I mean the same distro (PLD/Linux) and the same mysql version (5.1.34 but 5.1.35 is also affected) from PLD/Linux.
[7 Jul 2009 6:35] Arkadiusz Miskiewicz
valgrind reports this as:

==188096== Thread 3:                                                                                                                                         
==188096== Use of uninitialised value of size 4                                                                                                              
==188096==    at 0x81D940D: check_access(THD*, unsigned long, char const*, unsigned long*, bool, bool, bool) (in /usr/sbin/mysqld)                           
==188096==    by 0x81D9DF4: check_table_access(THD*, unsigned long, TABLE_LIST*, unsigned int, bool) (in /usr/sbin/mysqld)                                   
==188096==    by 0x81DD75E: mysql_execute_command(THD*) (in /usr/sbin/mysqld)                                                                                
==188096==    by 0x81E4E81: mysql_parse(THD*, char const*, unsigned int, char const**) (in /usr/sbin/mysqld)                                                 
==188096==  Uninitialised value was created by a stack allocation                                                                                            
==188096==    at 0x81D9BFD: check_table_access(THD*, unsigned long, TABLE_LIST*, unsigned int, bool) (in /usr/sbin/mysqld)                                   
==188096==                                                                                                                                                   
==188096== Use of uninitialised value of size 4                                                                                                              
==188096==    at 0x81BF5E3: set_thd_proc_info (in /usr/sbin/mysqld)                                                                                          
==188096==    by 0x81D9466: check_access(THD*, unsigned long, char const*, unsigned long*, bool, bool, bool) (in /usr/sbin/mysqld)                           
==188096==    by 0x81D9DF4: check_table_access(THD*, unsigned long, TABLE_LIST*, unsigned int, bool) (in /usr/sbin/mysqld)                                   
==188096==    by 0x81DD75E: mysql_execute_command(THD*) (in /usr/sbin/mysqld)                                                                                
==188096==    by 0x81E4E81: mysql_parse(THD*, char const*, unsigned int, char const**) (in /usr/sbin/mysqld)                                                 
==188096==  Uninitialised value was created by a stack allocation                                                                                            
==188096==    at 0x81D9BFD: check_table_access(THD*, unsigned long, TABLE_LIST*, unsigned int, bool) (in /usr/sbin/mysqld)                                   
==188096==                                                                                                                                                   
==188096== Use of uninitialised value of size 4                                                                                                              
==188096==    at 0x825236F: PROFILING::status_change(char const*, char const*, char const*, unsigned int) (in /usr/sbin/mysqld)                              
==188096==    by 0x81BF612: set_thd_proc_info (in /usr/sbin/mysqld)                                                                                          
==188096==    by 0x81D9466: check_access(THD*, unsigned long, char const*, unsigned long*, bool, bool, bool) (in /usr/sbin/mysqld)                           
==188096==    by 0x81D9DF4: check_table_access(THD*, unsigned long, TABLE_LIST*, unsigned int, bool) (in /usr/sbin/mysqld)                                   
==188096==    by 0x81DD75E: mysql_execute_command(THD*) (in /usr/sbin/mysqld)
==188096==    by 0x81E4E81: mysql_parse(THD*, char const*, unsigned int, char const**) (in /usr/sbin/mysqld)
==188096==  Uninitialised value was created by a stack allocation
==188096==    at 0x81D9BFD: check_table_access(THD*, unsigned long, TABLE_LIST*, unsigned int, bool) (in /usr/sbin/mysqld)
==188096==
==188096== Use of uninitialised value of size 4
==188096==    at 0x8252376: PROFILING::status_change(char const*, char const*, char const*, unsigned int) (in /usr/sbin/mysqld)
==188096==    by 0x81BF612: set_thd_proc_info (in /usr/sbin/mysqld)
==188096==    by 0x81D9466: check_access(THD*, unsigned long, char const*, unsigned long*, bool, bool, bool) (in /usr/sbin/mysqld)
==188096==    by 0x81D9DF4: check_table_access(THD*, unsigned long, TABLE_LIST*, unsigned int, bool) (in /usr/sbin/mysqld)
==188096==    by 0x81DD75E: mysql_execute_command(THD*) (in /usr/sbin/mysqld)
==188096==    by 0x81E4E81: mysql_parse(THD*, char const*, unsigned int, char const**) (in /usr/sbin/mysqld)
==188096==  Uninitialised value was created by a stack allocation
==188096==    at 0x81D9BFD: check_table_access(THD*, unsigned long, TABLE_LIST*, unsigned int, bool) (in /usr/sbin/mysqld)
==188096==
==188096== Invalid write of size 4
==188096==    at 0x82522E2: QUERY_PROFILE::new_status(char const*, char const*, char const*, unsigned int) (in /usr/sbin/mysqld)
==188096==    by 0x82523A4: PROFILING::status_change(char const*, char const*, char const*, unsigned int) (in /usr/sbin/mysqld)
==188096==    by 0x81BF612: set_thd_proc_info (in /usr/sbin/mysqld)
==188096==    by 0x81D9466: check_access(THD*, unsigned long, char const*, unsigned long*, bool, bool, bool) (in /usr/sbin/mysqld)
==188096==    by 0x81D9DF4: check_table_access(THD*, unsigned long, TABLE_LIST*, unsigned int, bool) (in /usr/sbin/mysqld)
==188096==    by 0x81DD75E: mysql_execute_command(THD*) (in /usr/sbin/mysqld)
==188096==    by 0x81E4E81: mysql_parse(THD*, char const*, unsigned int, char const**) (in /usr/sbin/mysqld)
==188096==  Address 0x76e82038 is not stack'd, malloc'd or (recently) free'd
==188096==
==188096== ERROR SUMMARY: 12 errors from 12 contexts (suppressed: 0 from 0)
==188096== malloc/free: in use at exit: 14,237,002 bytes in 30,349 blocks.
==188096== malloc/free: 30,881 allocs, 532 frees, 15,226,389 bytes allocated.
==188096== For counts of detected errors, rerun with: -v
==188096== searching for pointers to 30,349 not-freed blocks.
==188096== checked 6,371,780 bytes.
[7 Jul 2009 7:36] Arkadiusz Miskiewicz
--disable-profiling causes mysql to not segfault, so the bug hides somewhere in profiling code it seems.
[13 Jul 2009 0:26] Arkadiusz Miskiewicz
Looks like using -fomit-frame-pointer as opt flag was source of this problem.
[13 Jul 2009 7:46] Sveta Smirnova
Arkadiusz,

thank you for the feedback. You said:

> I mean the same distro (PLD/Linux)

but we don't provide special binaries for PLD/Linux. Please try our generic Linux binaries and inform us if they have same problem in your environment.
[13 Jul 2009 8:03] Arkadiusz Miskiewicz
I think you can close this one since we don't use and we don't want to use foreign binaries. 

We always built from source and building with -fomit-frame-pointer flag causes this problem.
[13 Jul 2009 8:18] Sveta Smirnova
Thank you for the feedback.

Re-closed as "Can't repeat"
[8 Sep 2010 21:15] Marc Elser
Just to let you know.

I encountered exactly the same problem and other people too, see here
http://bugs.gentoo.org/show_bug.cgi?id=335995

In all cases removing -fomit-frame-pointer from CFlags did help. Another strange thing is that it seems especially "pentium3" machines are affected as the other person which encountered the bug in the link above also has a Pentium3 as well as myself.

So, people at mysql maybe you should re-evaluate this case, but it's upt to you of course.
[11 Sep 2010 9:05] Stuart Shelton
I'm also encountering the same (or a similar) issue, regardless of whether '-fomit-frame-pointer' is specified.  MySQL crashes immediately on startup for me, with the following error log:

100911  9:41:43 - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.

key_buffer_size=16777216
read_buffer_size=262144
max_used_connections=0
max_threads=151
threads_connected=0
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 133324 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

thd: 0x85c6c98
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0xbf963144 thread_stack 0x30000
/usr/sbin/mysqld(my_print_stacktrace+0x1d) [0x8380047]
/usr/sbin/mysqld(handle_segfault+0x1cd) [0x81923b0]
[0xb7819400]
/usr/sbin/mysqld(open_table_def(THD*, st_table_share*, unsigned int)+0x7fd) [0x81d544d]
/usr/sbin/mysqld(get_table_share(THD*, TABLE_LIST*, char*, unsigned int, unsigned int, int*)+0x89) [0x81cded5]
/usr/sbin/mysqld() [0x81ce05a]
/usr/sbin/mysqld(open_table(THD*, TABLE_LIST*, st_mem_root*, bool*, unsigned int)+0x57a) [0x81ceb20]
/usr/sbin/mysqld(open_tables(THD*, TABLE_LIST**, unsigned int*, unsigned int)+0x1c1) [0x81cf181]
/usr/sbin/mysqld(open_and_lock_tables_derived(THD*, TABLE_LIST*, bool)+0x25) [0x81cf55f]
/usr/sbin/mysqld(plugin_init(int*, char**, int)+0x4da) [0x829ab5a]
/usr/sbin/mysqld() [0x8192c9d]
/usr/sbin/mysqld(main+0x279) [0x8194de5]
/lib/libc.so.6(__libc_start_main+0xfe) [0xb73d1bee]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at (nil) is an invalid pointer
thd->thread_id=0
thd->killed=NOT_KILLED
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.

... I've also added this information to the aforementioned Gentoo bug report.  The same data files worked without issue on MySQL 5.0 and below.