item.cc:

  Post fix for bug#23800.
  The Item_field constructor now increases the select_n_where_fields counter.
sql_yacc.yy:
  Post fix for bug#23800.
  Take into account fields that might be added by subselects.
sql_lex.h:
  Post fix for bug#23800.
  Added the select_n_where_fields variable to the st_select_lex class.
sql_lex.cc:
  Post fix for bug#23800.
  Initialization of the select_n_where_fields variable.

sql/item.cc

@@ -1664,7 +1664,10 @@ Item_field::Item_field(Name_resolution_context *context_arg,
    field(0), result_field(0), item_equal(0), no_const_subst(0),
    have_privileges(0), any_privileges(0), fixed_as_field(0)
 {
+  SELECT_LEX *select= current_thd->lex->current_select;
   collation.set(DERIVATION_IMPLICIT);
+  if (select && select->parsing_place != IN_HAVING)
+      select->select_n_where_fields++;
 }
 
 // Constructor need to process subselect with temporary tables (see Item)

sql/sql_lex.cc

@@ -1151,6 +1151,7 @@ void st_select_lex::init_query()
   cond_count= between_count= with_wild= 0;
   conds_processed_with_permanent_arena= 0;
   ref_pointer_array= 0;
+  select_n_where_fields= 0;
   select_n_having_items= 0;
   subquery_in_having= explicit_limit= 0;
   is_item_list_lookup= 0;
@@ -1550,6 +1551,7 @@ bool st_select_lex::setup_ref_array(THD *thd, uint order_group_num)
           (Item **)arena->alloc(sizeof(Item*) * (n_child_sum_items +
                                                  item_list.elements +
                                                  select_n_having_items +
+                                                 select_n_where_fields +
                                                  order_group_num)*5)) == 0;
 }
 

sql/sql_lex.h

@@ -530,6 +530,11 @@ public:
   uint select_n_having_items;
   uint cond_count;    /* number of arguments of and/or/xor in where/having/on */
   uint between_count; /* number of between predicates in where/having/on      */   
+  /*
+    Number of fields used in select list or where clause of current select
+    and all inner subselects.
+  */
+  uint select_n_where_fields;
   enum_parsing_place parsing_place; /* where we are parsing expression */
   bool with_sum_func;   /* sum function indicator */
   /* 

sql/sql_yacc.yy

@@ -9275,6 +9275,12 @@ subselect_end:
 	  lex->current_select = lex->current_select->return_after_parsing();
           lex->nest_level--;
           lex->current_select->n_child_sum_items += child->n_sum_items;
+          /*
+            A subselect can add fields to an outer select. Reserve space for
+            them.
+          */
+          lex->current_select->select_n_where_fields+=
+            child->select_n_where_fields;
 	};
 
 /**************************************************************************