Fix LP BUG#704337

Analysis:
The cause for the failing assert was that between preparation
and execution of a DELETE prepared statement, the server reverted
back all changes of the item tree. Since the substitution of
Item_in_subselect by an Item_in_optimizer was recorded via
change_item_tree, thus the rollback of the item tree affected
the substitution as well. As a result the execution of the PS
called Item_in_subselect::val_int(), which was never supposed
to be called.

Solution:
Replace change_item_tree with assignment. This is OK because
the Item objects used for substitution are created in PS memory.

sql/item_subselect.cc

@@ -228,9 +228,9 @@ bool Item_subselect::fix_fields(THD *thd_param, Item **ref)
         set correct WHERE/HAVING for PS.
       */
       if (unit->outer_select()->where == (*ref))
-        thd->change_item_tree(&(unit->outer_select()->where), substitution);
+        unit->outer_select()->where= substitution;
       else if (unit->outer_select()->having == (*ref))
-        thd->change_item_tree(&(unit->outer_select()->having), substitution);
+        unit->outer_select()->having= substitution;
 
       (*ref)= substitution;
       substitution->name= name;