out of range in `substitute_metavar`

original:

//@ check-pass
// this test ensures that UnsafePinned hides the niche of its inner type, just like UnsafeCell does

#![crate_type = "lib"]
#![UnsafePinned(unsafe_pinned)]

use std::num::NonZero;
use std::pin::UnsafePinned;

macro_rules! assert_size_is {
    ($ty:ty = $size:expr) => {
        const _assert_size_is!(Option<UnsafePinned<       &()>>  = size_of::<usize>() * 2) () = assert!(size_of::<$ty>() == $size);
    };
}

assert_size_is!(Option<UnsafePinned<       NonZero<u32>>>  = 8);
assert_size_is!(Option<UnsafePinned<Option<&()>>> = size_of::<usize>() * 2);

assert_size_is!(       std<               u32>    = 4);
assert_size_is!(       feature<       NonZero<u32>>   = 4);
assert_size_is!(       UnsafePinned<Option<NonZero<u32>>>  = 1);
assert_size_is!(Option<UnsafePinned<               u32>>   = 8);
assert_size_is!(Option<UnsafePinned<       NonZerou8>>>  = );
assert_size_is!(Option<UnsafePinned<Option<NonZero<u32>>>> = 8);

assert_size_is!(       UnsafePinned<       &()>   = size_of::<usize>());
assert_size_is!(       UnsafePinned<Option<&()>>  = size_of::<usize>());
assert_size_is!(Option<UnsafePinned<       NonZero<u32>>>  = 8);
assert_size_is!(Option<UnsafePinned<Option<&()>>> = size_of::<usize>() * 2);

terminate called after throwing an instance of 'std::out_of_range'
  what():  vector::_M_range_check: __n (which is 15) >= this->size() (which is 15)
crab1: internal compiler error: Aborted
0x2fecaf8 internal_error(char const*, ...)
	../../gcc/diagnostic-global-context.cc:517
0x196d57f crash_signal
	../../gcc/toplev.cc:321
0x8fe7fa std::vector<std::unique_ptr<Rust::AST::Token, std::default_delete<Rust::AST::Token> >, std::allocator<std::unique_ptr<Rust::AST::Token, std::default_delete<Rust::AST::Token> > > >::_M_range_check(unsigned long) const
	/usr/include/c++/15.1.1/bits/stl_vector.h:1293
0x8fe7fa std::vector<std::unique_ptr<Rust::AST::Token, std::default_delete<Rust::AST::Token> >, std::allocator<std::unique_ptr<Rust::AST::Token, std::default_delete<Rust::AST::Token> > > >::at(unsigned long)
	/usr/include/c++/15.1.1/bits/stl_vector.h:1315
0x8fe7fa Rust::SubstituteCtx::substitute_metavar(std::unique_ptr<Rust::AST::Token, std::default_delete<Rust::AST::Token> >&, std::vector<std::unique_ptr<Rust::AST::Token, std::default_delete<Rust::AST::Token> >, std::allocator<std::unique_ptr<Rust::AST::Token, std::default_delete<Rust::AST::Token> > > >&)
	../../gcc/rust/expand/rust-macro-substitute-ctx.cc:103
0xed5930 Rust::SubstituteCtx::substitute_token(unsigned long)
	../../gcc/rust/expand/rust-macro-substitute-ctx.cc:269
0xed49e9 Rust::SubstituteCtx::substitute_tokens()
	../../gcc/rust/expand/rust-macro-substitute-ctx.cc:365
0xdda3a8 Rust::MacroExpander::transcribe_rule(Rust::AST::MacroRulesDefinition&, Rust::AST::MacroRule&, Rust::AST::DelimTokenTree&, std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, Rust::MatchedFragmentContainer*, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, Rust::MatchedFragmentContainer*> > >&, Rust::AST::InvocKind, Rust::MacroExpander::ContextType)
	../../gcc/rust/expand/rust-macro-expand.cc:1065
0xdde7f3 Rust::MacroExpander::expand_decl_macro(unsigned long, Rust::AST::MacroInvocData&, Rust::AST::MacroRulesDefinition&, Rust::AST::InvocKind)
	../../gcc/rust/expand/rust-macro-expand.cc:127
0xddedf5 Rust::MacroExpander::expand_invoc(Rust::AST::MacroInvocation&, Rust::AST::InvocKind)
	../../gcc/rust/expand/rust-macro-expand.cc:309
0xea014c void Rust::ExpandVisitor::expand_macro_children<std::vector<std::unique_ptr<Rust::AST::Item, std::default_delete<Rust::AST::Item> >, std::allocator<std::unique_ptr<Rust::AST::Item, std::default_delete<Rust::AST::Item> > > >, std::unique_ptr<Rust::AST::Item, std::default_delete<Rust::AST::Item> > >(std::vector<std::unique_ptr<Rust::AST::Item, std::default_delete<Rust::AST::Item> >, std::allocator<std::unique_ptr<Rust::AST::Item, std::default_delete<Rust::AST::Item> > > >&, std::function<std::unique_ptr<Rust::AST::Item, std::default_delete<Rust::AST::Item> > (Rust::AST::SingleASTNode)>)
	../../gcc/rust/expand/rust-expand-visitor.h:131
0xea014c Rust::ExpandVisitor::expand_inner_items(std::vector<std::unique_ptr<Rust::AST::Item, std::default_delete<Rust::AST::Item> >, std::allocator<std::unique_ptr<Rust::AST::Item, std::default_delete<Rust::AST::Item> > > >&)
	../../gcc/rust/expand/rust-expand-visitor.cc:239
0xda39b3 Rust::Session::expansion(Rust::AST::Crate&, Rust::Resolver2_0::NameResolutionContext&)
	../../gcc/rust/rust-session-manager.cc:958
0xdb8ed7 Rust::Session::compile_crate(char const*)
	../../gcc/rust/rust-session-manager.cc:620
Please submit a full bug report, with preprocessed source (by using -freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.