==4078== Thread 12: ==4078== Invalid read of size 4 ==4078== at 0x814236C: Item_field::used_tables() const (item.cc:2124) ==4078== by 0x823B6C7: setup_fields(THD*, Item**, List&, enum_mark_columns, List*, bool) (sql_base.cc:7400) ==4078== by 0x825D9F1: JOIN::prepare(Item***, TABLE_LIST*, unsigned, Item*, unsigned, st_order*, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) (sql_select.cc:485) ==4078== by 0x8336AD3: st_select_lex_unit::prepare(THD*, select_result*, unsigned long) (sql_union.cc:264) ==4078== by 0x8338593: mysql_derived_prepare(THD*, st_lex*, TABLE_LIST*) (sql_derived.cc:151) ==4078== by 0x83382B5: mysql_handle_derived(st_lex*, bool (*)(THD*, st_lex*, TABLE_LIST*)) (sql_derived.cc:56) ==4078== by 0x828758F: mysql_multi_update_prepare(THD*) (sql_update.cc:969) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== by 0x834C997: sp_head::execute(THD*) (sp_head.cc:1248) ==4078== Address 0x7C231E4 is 28 bytes inside a block of size 996 free'd ==4078== at 0x400501A: free (vg_replace_malloc.c:233) ==4078== by 0x84B26C0: free_root (my_alloc.c:349) ==4078== by 0x8248877: closefrm(st_table*, bool) (table.cc:1985) ==4078== by 0x823E9D9: _ZL16free_cache_entryP8st_table (sql_base.cc:771) ==4078== by 0x84BA94B: my_hash_delete (hash.c:530) ==4078== by 0x823EFBA: close_thread_table(THD*, st_table**) (sql_base.cc:1357) ==4078== by 0x823F47B: close_thread_tables(THD*) (sql_base.cc:1166) ==4078== by 0x8287BF7: mysql_multi_update_prepare(THD*) (sql_update.cc:1130) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== ==4078== Invalid read of size 1 ==4078== at 0x8142371: Item_field::used_tables() const (item.cc:2124) ==4078== by 0x823B6C7: setup_fields(THD*, Item**, List&, enum_mark_columns, List*, bool) (sql_base.cc:7400) ==4078== by 0x825D9F1: JOIN::prepare(Item***, TABLE_LIST*, unsigned, Item*, unsigned, st_order*, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) (sql_select.cc:485) ==4078== by 0x8336AD3: st_select_lex_unit::prepare(THD*, select_result*, unsigned long) (sql_union.cc:264) ==4078== by 0x8338593: mysql_derived_prepare(THD*, st_lex*, TABLE_LIST*) (sql_derived.cc:151) ==4078== by 0x83382B5: mysql_handle_derived(st_lex*, bool (*)(THD*, st_lex*, TABLE_LIST*)) (sql_derived.cc:56) ==4078== by 0x828758F: mysql_multi_update_prepare(THD*) (sql_update.cc:969) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== by 0x834C997: sp_head::execute(THD*) (sp_head.cc:1248) ==4078== Address 0x141A2957 is 1,567 bytes inside a block of size 1,700 free'd ==4078== at 0x400501A: free (vg_replace_malloc.c:233) ==4078== by 0x84BA94B: my_hash_delete (hash.c:530) ==4078== by 0x823EFBA: close_thread_table(THD*, st_table**) (sql_base.cc:1357) ==4078== by 0x823F47B: close_thread_tables(THD*) (sql_base.cc:1166) ==4078== by 0x8287BF7: mysql_multi_update_prepare(THD*) (sql_update.cc:1130) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== by 0x834C997: sp_head::execute(THD*) (sp_head.cc:1248) ==4078== by 0x834D05D: sp_head::execute_procedure(THD*, List*) (sp_head.cc:1977) ==4078== by 0x82098B2: mysql_execute_command(THD*) (sql_parse.cc:4230) ==4078== ==4078== Invalid read of size 4 ==4078== at 0x8142390: Item_field::used_tables() const (item.cc:2126) ==4078== by 0x823B6C7: setup_fields(THD*, Item**, List&, enum_mark_columns, List*, bool) (sql_base.cc:7400) ==4078== by 0x825D9F1: JOIN::prepare(Item***, TABLE_LIST*, unsigned, Item*, unsigned, st_order*, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) (sql_select.cc:485) ==4078== by 0x8336AD3: st_select_lex_unit::prepare(THD*, select_result*, unsigned long) (sql_union.cc:264) ==4078== by 0x8338593: mysql_derived_prepare(THD*, st_lex*, TABLE_LIST*) (sql_derived.cc:151) ==4078== by 0x83382B5: mysql_handle_derived(st_lex*, bool (*)(THD*, st_lex*, TABLE_LIST*)) (sql_derived.cc:56) ==4078== by 0x828758F: mysql_multi_update_prepare(THD*) (sql_update.cc:969) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== by 0x834C997: sp_head::execute(THD*) (sp_head.cc:1248) ==4078== Address 0x141A291C is 1,508 bytes inside a block of size 1,700 free'd ==4078== at 0x400501A: free (vg_replace_malloc.c:233) ==4078== by 0x84BA94B: my_hash_delete (hash.c:530) ==4078== by 0x823EFBA: close_thread_table(THD*, st_table**) (sql_base.cc:1357) ==4078== by 0x823F47B: close_thread_tables(THD*) (sql_base.cc:1166) ==4078== by 0x8287BF7: mysql_multi_update_prepare(THD*) (sql_update.cc:1130) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== by 0x834C997: sp_head::execute(THD*) (sp_head.cc:1248) ==4078== by 0x834D05D: sp_head::execute_procedure(THD*, List*) (sp_head.cc:1977) ==4078== by 0x82098B2: mysql_execute_command(THD*) (sql_parse.cc:4230) ==4078== ==4078== Invalid read of size 4 ==4078== at 0x8142396: Item_field::used_tables() const (item.cc:2126) ==4078== by 0x823B6C7: setup_fields(THD*, Item**, List&, enum_mark_columns, List*, bool) (sql_base.cc:7400) ==4078== by 0x825D9F1: JOIN::prepare(Item***, TABLE_LIST*, unsigned, Item*, unsigned, st_order*, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) (sql_select.cc:485) ==4078== by 0x8336AD3: st_select_lex_unit::prepare(THD*, select_result*, unsigned long) (sql_union.cc:264) ==4078== by 0x8338593: mysql_derived_prepare(THD*, st_lex*, TABLE_LIST*) (sql_derived.cc:151) ==4078== by 0x83382B5: mysql_handle_derived(st_lex*, bool (*)(THD*, st_lex*, TABLE_LIST*)) (sql_derived.cc:56) ==4078== by 0x828758F: mysql_multi_update_prepare(THD*) (sql_update.cc:969) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== by 0x834C997: sp_head::execute(THD*) (sp_head.cc:1248) ==4078== Address 0x141A2920 is 1,512 bytes inside a block of size 1,700 free'd ==4078== at 0x400501A: free (vg_replace_malloc.c:233) ==4078== by 0x84BA94B: my_hash_delete (hash.c:530) ==4078== by 0x823EFBA: close_thread_table(THD*, st_table**) (sql_base.cc:1357) ==4078== by 0x823F47B: close_thread_tables(THD*) (sql_base.cc:1166) ==4078== by 0x8287BF7: mysql_multi_update_prepare(THD*) (sql_update.cc:1130) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== by 0x834C997: sp_head::execute(THD*) (sp_head.cc:1248) ==4078== by 0x834D05D: sp_head::execute_procedure(THD*, List*) (sp_head.cc:1977) ==4078== by 0x82098B2: mysql_execute_command(THD*) (sql_parse.cc:4230) ==4078== ==4078== Invalid read of size 4 ==4078== at 0x825B03B: create_tmp_field(THD*, st_table*, Item*, Item::Type, Item***, Field**, Field**, bool, bool, bool, bool, unsigned) (field.h:263) ==4078== by 0x82616FF: create_tmp_table(THD*, TMP_TABLE_PARAM*, List&, st_order*, bool, bool, unsigned long long, unsigned long long, char*) (sql_select.cc:9864) ==4078== by 0x8335A04: select_union::create_result_table(THD*, List*, bool, unsigned long long, char const*) (sql_union.cc:122) ==4078== by 0x8338734: mysql_derived_prepare(THD*, st_lex*, TABLE_LIST*) (sql_derived.cc:169) ==4078== by 0x83382B5: mysql_handle_derived(st_lex*, bool (*)(THD*, st_lex*, TABLE_LIST*)) (sql_derived.cc:56) ==4078== by 0x828758F: mysql_multi_update_prepare(THD*) (sql_update.cc:969) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== by 0x834C997: sp_head::execute(THD*) (sp_head.cc:1248) ==4078== by 0x834D05D: sp_head::execute_procedure(THD*, List*) (sp_head.cc:1977) ==4078== Address 0x7C231E0 is 24 bytes inside a block of size 996 free'd ==4078== at 0x400501A: free (vg_replace_malloc.c:233) ==4078== by 0x84B26C0: free_root (my_alloc.c:349) ==4078== by 0x8248877: closefrm(st_table*, bool) (table.cc:1985) ==4078== by 0x823E9D9: _ZL16free_cache_entryP8st_table (sql_base.cc:771) ==4078== by 0x84BA94B: my_hash_delete (hash.c:530) ==4078== by 0x823EFBA: close_thread_table(THD*, st_table**) (sql_base.cc:1357) ==4078== by 0x823F47B: close_thread_tables(THD*) (sql_base.cc:1166) ==4078== by 0x8287BF7: mysql_multi_update_prepare(THD*) (sql_update.cc:1130) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== ==4078== Invalid read of size 4 ==4078== at 0x825AB97: create_tmp_field_from_field(THD*, Field*, char const*, st_table*, Item_field*, unsigned) (sql_select.cc:9195) ==4078== by 0x825AE52: create_tmp_field(THD*, st_table*, Item*, Item::Type, Item***, Field**, Field**, bool, bool, bool, bool, unsigned) (sql_select.cc:9477) ==4078== by 0x82616FF: create_tmp_table(THD*, TMP_TABLE_PARAM*, List&, st_order*, bool, bool, unsigned long long, unsigned long long, char*) (sql_select.cc:9864) ==4078== by 0x8335A04: select_union::create_result_table(THD*, List*, bool, unsigned long long, char const*) (sql_union.cc:122) ==4078== by 0x8338734: mysql_derived_prepare(THD*, st_lex*, TABLE_LIST*) (sql_derived.cc:169) ==4078== by 0x83382B5: mysql_handle_derived(st_lex*, bool (*)(THD*, st_lex*, TABLE_LIST*)) (sql_derived.cc:56) ==4078== by 0x828758F: mysql_multi_update_prepare(THD*) (sql_update.cc:969) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== by 0x834C997: sp_head::execute(THD*) (sp_head.cc:1248) ==4078== Address 0x7C231D8 is 16 bytes inside a block of size 996 free'd ==4078== at 0x400501A: free (vg_replace_malloc.c:233) ==4078== by 0x84B26C0: free_root (my_alloc.c:349) ==4078== by 0x8248877: closefrm(st_table*, bool) (table.cc:1985) ==4078== by 0x823E9D9: _ZL16free_cache_entryP8st_table (sql_base.cc:771) ==4078== by 0x84BA94B: my_hash_delete (hash.c:530) ==4078== by 0x823EFBA: close_thread_table(THD*, st_table**) (sql_base.cc:1357) ==4078== by 0x823F47B: close_thread_tables(THD*) (sql_base.cc:1166) ==4078== by 0x8287BF7: mysql_multi_update_prepare(THD*) (sql_update.cc:1130) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== ==4078== Invalid read of size 4 ==4078== at 0x825AB99: create_tmp_field_from_field(THD*, Field*, char const*, st_table*, Item_field*, unsigned) (sql_select.cc:9195) ==4078== by 0x825AE52: create_tmp_field(THD*, st_table*, Item*, Item::Type, Item***, Field**, Field**, bool, bool, bool, bool, unsigned) (sql_select.cc:9477) ==4078== by 0x82616FF: create_tmp_table(THD*, TMP_TABLE_PARAM*, List&, st_order*, bool, bool, unsigned long long, unsigned long long, char*) (sql_select.cc:9864) ==4078== by 0x8335A04: select_union::create_result_table(THD*, List*, bool, unsigned long long, char const*) (sql_union.cc:122) ==4078== by 0x8338734: mysql_derived_prepare(THD*, st_lex*, TABLE_LIST*) (sql_derived.cc:169) ==4078== by 0x83382B5: mysql_handle_derived(st_lex*, bool (*)(THD*, st_lex*, TABLE_LIST*)) (sql_derived.cc:56) ==4078== by 0x828758F: mysql_multi_update_prepare(THD*) (sql_update.cc:969) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== by 0x834C997: sp_head::execute(THD*) (sp_head.cc:1248) ==4078== Address 0x7C231E4 is 28 bytes inside a block of size 996 free'd ==4078== at 0x400501A: free (vg_replace_malloc.c:233) ==4078== by 0x84B26C0: free_root (my_alloc.c:349) ==4078== by 0x8248877: closefrm(st_table*, bool) (table.cc:1985) ==4078== by 0x823E9D9: _ZL16free_cache_entryP8st_table (sql_base.cc:771) ==4078== by 0x84BA94B: my_hash_delete (hash.c:530) ==4078== by 0x823EFBA: close_thread_table(THD*, st_table**) (sql_base.cc:1357) ==4078== by 0x823F47B: close_thread_tables(THD*) (sql_base.cc:1166) ==4078== by 0x8287BF7: mysql_multi_update_prepare(THD*) (sql_update.cc:1130) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== ==4078== Invalid read of size 4 ==4078== at 0x81CA72A: Field::new_field(st_mem_root*, st_table*, bool) (field.cc:1779) ==4078== by 0x825ABB9: create_tmp_field_from_field(THD*, Field*, char const*, st_table*, Item_field*, unsigned) (sql_select.cc:9195) ==4078== by 0x825AE52: create_tmp_field(THD*, st_table*, Item*, Item::Type, Item***, Field**, Field**, bool, bool, bool, bool, unsigned) (sql_select.cc:9477) ==4078== by 0x82616FF: create_tmp_table(THD*, TMP_TABLE_PARAM*, List&, st_order*, bool, bool, unsigned long long, unsigned long long, char*) (sql_select.cc:9864) ==4078== by 0x8335A04: select_union::create_result_table(THD*, List*, bool, unsigned long long, char const*) (sql_union.cc:122) ==4078== by 0x8338734: mysql_derived_prepare(THD*, st_lex*, TABLE_LIST*) (sql_derived.cc:169) ==4078== by 0x83382B5: mysql_handle_derived(st_lex*, bool (*)(THD*, st_lex*, TABLE_LIST*)) (sql_derived.cc:56) ==4078== by 0x828758F: mysql_multi_update_prepare(THD*) (sql_update.cc:969) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) ==4078== Address 0x7C231D8 is 16 bytes inside a block of size 996 free'd ==4078== at 0x400501A: free (vg_replace_malloc.c:233) ==4078== by 0x84B26C0: free_root (my_alloc.c:349) ==4078== by 0x8248877: closefrm(st_table*, bool) (table.cc:1985) ==4078== by 0x823E9D9: _ZL16free_cache_entryP8st_table (sql_base.cc:771) ==4078== by 0x84BA94B: my_hash_delete (hash.c:530) ==4078== by 0x823EFBA: close_thread_table(THD*, st_table**) (sql_base.cc:1357) ==4078== by 0x823F47B: close_thread_tables(THD*) (sql_base.cc:1166) ==4078== by 0x8287BF7: mysql_multi_update_prepare(THD*) (sql_update.cc:1130) ==4078== by 0x8206BE2: mysql_execute_command(THD*) (sql_parse.cc:2976) ==4078== by 0x834A1C0: sp_instr_stmt::exec_core(THD*, unsigned*) (sp_head.cc:2899) ==4078== by 0x834E381: sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned*, bool, sp_instr*) (sp_head.cc:2728) ==4078== by 0x834F029: sp_instr_stmt::execute(THD*, unsigned*) (sp_head.cc:2842) mysqld: my_new.cc:50: int __cxa_pure_virtual(): Assertion `"Pure virtual method called." == "Aborted"' failed. 081230 10:10:37 - mysqld got signal 6 ; This could be because you hit a bug. It is also possible that this binary or one of the libraries it was linked against is corrupt, improperly built, or misconfigured. This error can also be caused by malfunctioning hardware. We will try our best to scrape up some info that will hopefully help diagnose the problem, but since we have already crashed, something is definitely wrong and this may fail. key_buffer_size=8388600 read_buffer_size=131072 max_used_connections=21 max_threads=151 threads_connected=21 It is possible that mysqld could use up to key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 337725 K bytes of memory Hope that's ok; if not, decrease some variables in the equation. thd: 0x7a0c5f0 Attempting backtrace. You can use the following information to find out where mysqld died. If you see no messages after this, something went terribly wrong... stack_bottom = 0x506c3b8 thread_stack 0x30000 ./bin/mysqld(my_print_stacktrace+0x21)[0x84c64f1] ./bin/mysqld(handle_segfault+0x381)[0x81f6261] /lib/libpthread.so.0[0x491218] /lib/libc.so.6(abort+0x101)[0x406a591] /lib/libc.so.6(__assert_fail+0xfb)[0x406238b] ./bin/mysqld(__cxa_pure_virtual+0x36)[0x84b2ec6] ./bin/mysqld(_ZN5Field9new_fieldEP11st_mem_rootP8st_tableb+0x15)[0x81ca735] ./bin/mysqld(_Z27create_tmp_field_from_fieldP3THDP5FieldPKcP8st_tableP10Item_fieldj+0x4a)[0x825abba] ./bin/mysqld(_Z16create_tmp_fieldP3THDP8st_tableP4ItemNS3_4TypeEPPS4_PP5FieldSA_bbbbj+0xc3)[0x825ae53] ./bin/mysqld(_Z16create_tmp_tableP3THDP15TMP_TABLE_PARAMR4ListI4ItemEP8st_orderbbyyPc+0x770)[0x8261700] ./bin/mysqld(_ZN12select_union19create_result_tableEP3THDP4ListI4ItemEbyPKc+0x85)[0x8335a05] ./bin/mysqld(_Z21mysql_derived_prepareP3THDP6st_lexP10TABLE_LIST+0x285)[0x8338735] ./bin/mysqld(_Z20mysql_handle_derivedP6st_lexPFbP3THDS0_P10TABLE_LISTE+0x66)[0x83382b6] ./bin/mysqld(_Z26mysql_multi_update_prepareP3THD+0xc0)[0x8287590] ./bin/mysqld(_Z21mysql_execute_commandP3THD+0x1093)[0x8206be3] ./bin/mysqld(_ZN13sp_instr_stmt9exec_coreEP3THDPj+0x11)[0x834a1c1] ./bin/mysqld(_ZN13sp_lex_keeper23reset_lex_and_exec_coreEP3THDPjbP8sp_instr+0xc2)[0x834e382] ./bin/mysqld(_ZN13sp_instr_stmt7executeEP3THDPj+0x10a)[0x834f02a] ./bin/mysqld(_ZN7sp_head7executeEP3THD+0x4d8)[0x834c998] ./bin/mysqld(_ZN7sp_head17execute_procedureEP3THDP4ListI4ItemE+0x4fe)[0x834d05e] ./bin/mysqld(_Z21mysql_execute_commandP3THD+0x3d63)[0x82098b3] ./bin/mysqld(_Z11mysql_parseP3THDPKcjPS2_+0x340)[0x820d1c0] ./bin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0xe98)[0x820e068] ./bin/mysqld(_Z10do_commandP3THD+0xe0)[0x820ebf0] ./bin/mysqld(handle_one_connection+0x233)[0x81ff8a3] /lib/libpthread.so.0[0x4893db] /lib/libc.so.6(clone+0x5e)[0x410d06e] Trying to get some variables. Some pointers may be invalid and cause the dump to abort... thd->query at 0x1ecd2c38 is an invalid pointer thd->thread_id=3 thd->killed=NOT_KILLED The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains information that should help you find out what is causing the crash.