MDEV-28448 Assertion failure for SELECT with subquery using ON expression

This patch corrects the fix for MDEV-26412.
Note that when parsing an ON expression the pointer to the current select
is always in select_stack[select_stack_top - 1]. So the pointer to the
outer select (if any) is in select_stack[select_stack_top - 2].

The query manifesting this bug is added to the test case of MDEV-26412.

3 files changed, 10 insertions, 1 deletions

diff --git a/mysql-test/main/insert.result b/mysql-test/main/insert.result
index 1062ddd6a94..af7dcbedd1f 100644
--- a/mysql-test/main/insert.result
+++ b/mysql-test/main/insert.result
@@ -766,4 +766,8 @@ replace t4
 select * from t1 left join t2 on (select t1.i from t3);
 ERROR 42S22: Unknown column 't1.i' in 'field list'
 drop table t1,t2,t3,t4;
+create table t (a int);
+select 1 in (select count(*) from t t1 join (t t2 join t t3 on (t1.a != 0)));
+ERROR 42S22: Unknown column 't1.a' in 'on clause'
+drop table t;
 # End of 10.4 tests
diff --git a/mysql-test/main/insert.test b/mysql-test/main/insert.test
index 9fd0933cc7c..27d44918bbb 100644
--- a/mysql-test/main/insert.test
+++ b/mysql-test/main/insert.test
@@ -633,4 +633,9 @@ replace t4
 
 drop table t1,t2,t3,t4;
 
+create table t (a int);
+--error ER_BAD_FIELD_ERROR
+select 1 in (select count(*) from t t1 join (t t2 join t t3 on (t1.a != 0)));
+drop table t;
+
 --echo # End of 10.4 tests
diff --git a/sql/sql_lex.h b/sql/sql_lex.h
index 3e35d16d355..6a3a01f69d6 100644
--- a/sql/sql_lex.h
+++ b/sql/sql_lex.h
@@ -3700,7 +3700,7 @@ public:
   SELECT_LEX *parser_current_outer_select()
   {
     return select_stack_top - 1 == select_stack_outer_barrier ?
-             0 : select_stack[select_stack_top - 1];
+             0 : select_stack[select_stack_top - 2];
   }
 
   Name_resolution_context *current_context()