Fix LP BUG#704337

Analysis:
The cause for the failing assert was that between preparation
and execution of a DELETE prepared statement, the server reverted
back all changes of the item tree. Since the substitution of
Item_in_subselect by an Item_in_optimizer was recorded via
change_item_tree, thus the rollback of the item tree affected
the substitution as well. As a result the execution of the PS
called Item_in_subselect::val_int(), which was never supposed
to be called.

Solution:
Replace change_item_tree with assignment. This is OK because
the Item objects used for substitution are created in PS memory.

1 files changed, 2 insertions, 2 deletions

diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index 62042380a7e..b30cf450d6d 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -228,9 +228,9 @@ bool Item_subselect::fix_fields(THD *thd_param, Item **ref)
         set correct WHERE/HAVING for PS.
       */
       if (unit->outer_select()->where == (*ref))
-        thd->change_item_tree(&(unit->outer_select()->where), substitution);
+        unit->outer_select()->where= substitution;
       else if (unit->outer_select()->having == (*ref))
-        thd->change_item_tree(&(unit->outer_select()->having), substitution);
+        unit->outer_select()->having= substitution;
 
       (*ref)= substitution;
       substitution->name= name;