subquery_to_derived duplicate name

With optimizer_switch='subquery_to_derived=on', running the reproducer below on a freshly created schema crashes the server process. The query was expected to return a result set (or at worst a query-level error) without affecting the server, but instead the server crashes. With subquery_to_derived=off the same query runs fine.

Crash SQL

CREATE TABLE t1 (a BIGINT PRIMARY KEY, b BIGINT);
CREATE TABLE t2 (a BIGINT PRIMARY KEY);

SELECT /*+ SET_VAR(optimizer_switch='subquery_to_derived=on') */
       COUNT(DISTINCT s.a) = (SELECT COUNT(DISTINCT s1.a)
                              FROM t2 s1 WHERE s1.a = o.b) AS x
FROM t1 o LEFT JOIN t2 s ON o.b = s.a
GROUP BY o.a, o.b;

Start by running the supplied SQL reproducer on a freshly created schema with subquery_to_derived enabled, then compare it with the setting disabled. Trace the optimizer path that transforms the subquery and handles duplicate names; done means the query no longer crashes the server and instead returns a result set or a query-level error.