[GromNaN]

walkSubSelect() restored $inSubSelect to false unconditionally, so a nested subselect cleared the flag while the outer one was still being walked. The path expressions that followed were recorded as ORDER BY expressions and added to the outer SELECT, including aliases that only exist inside the IN subselect. The query failed with Unknown column 'c1_.id' in 'field list'.

The flag now restores its previous value.

Before:

SELECT p0_.id AS id_0, c1_.id AS id_1, c1_.name AS name_2, c1_.rank AS rank_3,
       c2_.id AS id_4, c2_.name AS name_5, c2_.rank AS rank_6,
       c1_.parent_id AS parent_id_7, c2_.parent_id AS parent_id_8

After:

SELECT p0_.id AS id_0, c1_.id AS id_1, c1_.name AS name_2, c1_.rank AS rank_3,
       c1_.parent_id AS parent_id_4

The extra c1_ columns in the first block come from the IN subselect. They no longer leak into the outer SELECT.

Fixes #12697.