Panic in a query with NATURAL JOIN (SQLancer)

[2010YOUY01]

Describe the bug

See reproducer in datafusion-cli (compiled from latest main, commit hash 3f4297f)

DataFusion CLI v44.0.0
> create table t1(v1 int, v2 int);
0 row(s) fetched.
Elapsed 0.021 seconds.

> select v1 from t1 as tt1 natural join t1 as tt2 group by v1 order by v2;
thread 'main' panicked at /Users/yongting/Code/datafusion/datafusion/expr/src/logical_plan/plan.rs:909:17:
assertion `left == right` failed
  left: 3
 right: 2
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

To Reproduce

No response

Expected behavior

column reference v2 in order by clause is invalid, the query should return an error instead like

> select v1 from t1 group by v1 order by v2;
Schema error: No field named t1.v2. Valid fields are t1.v1.

Additional context

Found by SQLancer #11030

[jonahgao]

Panic occurred in add_missing_columns. Might be related to #10326

I plan to investigate it further, thank you @2010YOUY01 for reporting it.

[alamb]

THanks @2010YOUY01 and @jonahgao