MDEV-28448 Assertion failure for SELECT with subquery using ON expression

This patch corrects the fix for MDEV-26412.
Note that when parsing an ON expression the pointer to the current select
is always in select_stack[select_stack_top - 1]. So the pointer to the
outer select (if any) is in select_stack[select_stack_top - 2].

The query manifesting this bug is added to the test case of MDEV-26412.

mysql-test/main/insert.result

@@ -766,4 +766,8 @@ replace t4
 select * from t1 left join t2 on (select t1.i from t3);
 ERROR 42S22: Unknown column 't1.i' in 'field list'
 drop table t1,t2,t3,t4;
+create table t (a int);
+select 1 in (select count(*) from t t1 join (t t2 join t t3 on (t1.a != 0)));
+ERROR 42S22: Unknown column 't1.a' in 'on clause'
+drop table t;
 # End of 10.4 tests

mysql-test/main/insert.test

@@ -633,4 +633,9 @@ replace t4
 
 drop table t1,t2,t3,t4;
 
+create table t (a int);
+--error ER_BAD_FIELD_ERROR
+select 1 in (select count(*) from t t1 join (t t2 join t t3 on (t1.a != 0)));
+drop table t;
+
 --echo # End of 10.4 tests

sql/sql_lex.h

@@ -3700,7 +3700,7 @@ struct LEX: public Query_tables_list
   SELECT_LEX *parser_current_outer_select()
   {
     return select_stack_top - 1 == select_stack_outer_barrier ?
-             0 : select_stack[select_stack_top - 1];
+             0 : select_stack[select_stack_top - 2];
   }
 
   Name_resolution_context *current_context()