SQL_PREPARE.CC, LINE 2502

This bug was introduced by the fix for bug #15875919.

Problem: An assertion fires when executing a prepared statement with a
subquery in the ON clause of a join in a subquery that is removed by
remove_redundant_subquery_clauses().

An ALL/ANY/SOME/IN subquery may contain ORDER BY and GROUP BY clauses
that are not needed. These are removed by
remove_redundant_subquery_clauses(). If such a clause contains a
subquery, the subquery is also removed. The st_select_lex_unit and
st_select_lex objects of the subquery should be unlinked from the
outer query and from LEX::all_selects_list. This is done by doing a
walk() on the clause with Item_subselect::clean_up_after_removal()
doing the actual removal. This walk was added in the fix for bug
#15875919.

If a subquery that is removed in this way has an ON clause with
another subquery, the walk will fail to find this second
subquery. Item_subselect::walk() does not call the walk processor
function on its ON clauses. Because of this, Item_subselects in ON
clauses and their st_select_lex objects are not removed properly from
LEX::all_selects_list. However, the master and slave links are cut at
one point, so the subquery is out of the tree of select_lex_nodes, but
there's still a pointer in LEX::all_selects_list. When the prepared
statement is executed, reinit_stmt_before_use() will follow this
pointer and find a st_select_lex object without a JOIN object.

Fix: Walk join conditions in Item_subselect::walk(). This is done by
adding a new function, Item_subselect::walk_join_condition() that goes
through nested joins and walks all join conditions.

This patch also changes the order in which parts of an Item_subselect
is walked to a more natural order.