Re: Assertion `0' failed in replace_where_subcondition with derived_merge and first execution of prepared statement
Also reproducible without a subquery in the ON clause. Let me know if you require such a testcase.

Re: Assertion `0' failed in replace_where_subcondition with derived_merge and first execution of prepared statement
Test case without subquery in the ON clause:

CREATE TABLE t1 ( b int(11)) ;

CREATE TABLE t2 (c int, b int, d varchar(52) NOT NULL ) ;

CREATE TABLE t3 (b int(11)) ;

SET SESSION optimizer_switch='semijoin=on,derived_merge=on';
PREPARE st1 FROM '
SELECT * FROM t1
JOIN (
SELECT t2.* FROM t2
WHERE t2.d <> "a"
AND t2.c IN (
SELECT t3.b
FROM t3
)
) AS alias2
ON ( alias2.b = t1.b );
';
EXECUTE st1;

Re: Assertion `0' failed in replace_where_subcondition with derived_merge and first execution of prepared statement
The crash happens inside convert_join_subqueries_to_semijoins(). replace_where_subcondition() throws an assert, because it was unable to locate the subquery item that it needs to replace.

Re: Assertion `0' failed in replace_where_subcondition with derived_merge and first execution of prepared statement
The code goes like this:

Item **tree= (in_subq->emb_on_expr_nest == NO_JOIN_NEST)?
&join->conds : &(in_subq->emb_on_expr_nest->on_expr);
Item *replace_me= in_subq->original_item();
if (replace_where_subcondition(join, tree, replace_me, substitute,
do_fix_fields))
DBUG_RETURN(TRUE);

...

if (!thd->stmt_arena->is_conventional())

the assert happens inside the second invocation. We fail to replace Item_in_subselect in prep_on_expr, because prep_on_expr shares the "sub-item" that contains Item_in_subselect with on_expr.

First, we do [successfull] replace in on_expr, which also makes the replace in prep_on_expr.
Second, we attempt to do the replace in prep_on_expr, and that fails.

Launchpad bug id: 878753