I just realized I hadn't had iptables for real for four days and four hours. It happened after I updated iptables to the newest stable version 1.4.16.3 on Gentoo, officially released on 10/18/2012):
$ sudo genlop -lu | grep iptables | tail -3
     Tue May  8 08:51:55 2012 >>> net-firewall/iptables-1.4.13
     Mon Nov 26 01:46:33 2012 <<< net-firewall/iptables-1.4.13
     Mon Nov 26 01:46:39 2012 >>> net-firewall/iptables-1.4.16.3
Yesterday, I noticed there was an error or warning during booting, but I just assumed that's some net device was about to be brought up, didn't read the exact message. Today, I read it:
$ sudo /etc/init.d/iptables start
 * Loading iptables state and starting firewall ...
WARNING: The state match is obsolete. Use conntrack instead.
iptables-restore v1.4.16.3: state: option "--state" must be specified

Error occurred at line: 26
Try `iptables-restore -h' or 'iptables-restore --help' for more information.                                    [ !! ]
 * ERROR: iptables failed to start
Four days, four boots, should've paid more attention.

The problem line was like:
[52:3148] -A INPUT -s ###.###.###.### -p tcp -m state -m tcp --dport ### -j ACCEPT
After I remove six lines with -m state, the rules /var/lib/iptables/rules-save were loaded successfully. Don't know why I had those and didn't use to match state actually.

If you used state match, then you need to change it to be
-m conntrack --ctstate [STATELIST]
with kernel configuration NETFILTER_XT_MATCH_CONNTRACK. See man 8 iptables-extensions.