BUG#952372: Server crashes on 2nd execution of PS in find_field_in_tables with semijoin+materialization

- The problem was that convert_subq_to_jtbm() attached the semi-join
  TABLE_LIST object into the wrong list: they used to attach it to the 
  end of parent_lex->leaf_tables.head()->next_local->...->next_local.
  This was apparently inccorect, as one can construct an example where 
  JTBM nest is attached to a table that is inside some mergeable VIEW, which
  breaks (causes crash) for name resolution on the subsequent statement
  re-execution.
- Solution: Attach to the "right" list. The "wording" was copied from
  st_select_lex::handle_derived.

mysql-test/t/subselect_sj.test

@@ -2331,5 +2331,27 @@ explain select * from t3 where a in (select kp1 from t1 where kp1<20);
 drop table t0,t1,t3;
 set optimizer_switch= @tmp_923246;
 
+
+--echo #
+--echo # BUG#952372: Server crashes on 2nd execution of PS in find_field_in_tables with semijoin+materialization
+--echo #
+CREATE TABLE t1 ( a INT );
+INSERT INTO t1 VALUES (2),(3);
+CREATE VIEW v1 AS SELECT * FROM t1;
+
+CREATE TABLE t2 ( b VARCHAR(1) );
+INSERT INTO t2 VALUES ('v'),('v');
+
+PREPARE pstmt FROM
+  'SELECT DISTINCT a FROM v1, t2
+   WHERE b IN ( SELECT MIN(b) FROM t2 )';
+
+EXECUTE pstmt;
+EXECUTE pstmt;
+
+DEALLOCATE PREPARE pstmt;
+DROP VIEW v1;
+DROP TABLE t1, t2;
+
 # The following command must be the last one the file 
 set optimizer_switch=@subselect_sj_tmp;