LP:910817 - Race condition in kill_threads_for_user

kill_threads_for_user has a race condition which can result in invalid pointer in the threads_to_kill list.

while ((ptr= it++))

{ ptr->awake(kill_signal); mysql_mutex_unlock(&ptr->LOCK_thd_data); (*rows)++; }

The problem with this code is that once ptr->LOCK_thd_data is unlocked, very short thereafter memory pointed to by
'ptr' can be freed, and the ptr->next becomes invalid, and ptr=it++ might crash.

Possible fix would be calculating 'next' pointer before unlocking the LOCK_thd_data.