Bad offsets causing panicking threads

rust-analyzer version:

rust-analyzer version: 0.3.2870-standalone [/home/techn0/.vscode/extensions/rust-lang.rust-analyzer-0.3.2870-linux-x64/server/rust-analyzer]

rustc version: rustc 1.95.0 (59807616e 2026-04-14)

editor or extension: VS Code

relevant settings:
this is all I have:

{
  "rust-analyzer.check.features": [],
  "rust-analyzer.check.allTargets": true,
  "rust-analyzer.check.command": "clippy",
  "rust-analyzer.assist.emitMustUse": true,
  "rust-analyzer.cargo.targetDir": true,
  "rust-analyzer.debug.engine": "vadimcn.vscode-lldb",
  "rust-analyzer.diagnostics.enable": false,
  "rust-analyzer.hover.actions.references.enable": true,
  "rust-analyzer.imports.granularity.enforce": true,
  "rust-analyzer.inlayHints.bindingModeHints.enable": true,
  "rust-analyzer.inlayHints.closingBraceHints.minLines": 1,
  "rust-analyzer.inlayHints.closureReturnTypeHints.enable": "always",
  "rust-analyzer.inlayHints.lifetimeElisionHints.enable": "always",
  "rust-analyzer.inlayHints.lifetimeElisionHints.useParameterNames": true,
  "rust-analyzer.inlayHints.maxLength": null,
  "rust-analyzer.inlayHints.reborrowHints.enable": "always",
  "rust-analyzer.inlayHints.typeHints.hideClosureInitialization": true,
  "rust-analyzer.lens.references.adt.enable": true,
  "rust-analyzer.lens.references.enumVariant.enable": true,
  "rust-analyzer.lens.references.method.enable": true,
  "rust-analyzer.lens.references.trait.enable": true,
  "rust-analyzer.restartServerOnConfigChange": true,
  "rust-analyzer.runnables.askBeforeUpdateTest": false,
  "rust-analyzer.rustfmt.rangeFormatting.enable": true,
  "rust-analyzer.trace.server": "verbose",
  "rust-analyzer.showSyntaxTree": true,
}

repository link: rust-analyzer

code snippet to reproduce:
technically it happens on the use foo$0::Foo; line

#[test]
fn external_docs_doc_url_crate() {
    check_external_docs(
        r#"
//- /main.rs crate:main deps:foo
use foo$0::Foo;
//- /lib.rs crate:foo
pub struct Foo;
"#,
        Some("/home/user/project"),
        Some(expect![[r#"https://docs.rs/foo/*/foo/index.html"#]]),
        Some(expect![[r#"file:///home/user/project/doc/foo/index.html"#]]),
        Some("/sysroot"),
    );
}

thread 'Worker9' (576828) panicked at /github/home/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rowan-0.15.18/src/cursor.rs:755:9:
Bad offset: range 0..14 offset 33
stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: rowan::cursor::SyntaxNode::token_at_offset
   3: ide::hover::hover_offset
   4: ide::hover::hover
   5: salsa::cancelled::Cancelled::catch
   6: std::thread::local::LocalKey<T>::with
   7: ide::Analysis::hover
   8: ide::hover::hover_offset
   9: ide::hover::hover
  10: salsa::cancelled::Cancelled::catch
  11: std::thread::local::LocalKey<T>::with
  12: ide::Analysis::hover
  13: rust_analyzer::handlers::request::handle_hover
  14: core::ops::function::FnOnce::call_once{{vtable.shim}}
  15: <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
additional context:
   0: 
version: 0.3.2870-standalone
request: textDocument/hover HoverParams {
    text_document: TextDocumentIdentifier {
        uri: Url {
            scheme: "file",
            cannot_be_a_base: false,
            username: "",
            password: None,
            host: None,
            port: None,
            path: "/home/techn0/source/rust-analyzer/crates/ide/src/doc_links/tests.rs",
            query: None,
            fragment: None,
        },
    },
    position: Position(
        Position {
            line: 150,
            character: 19,
        },
    ),
    work_done_progress_params: WorkDoneProgressParams {
        work_done_token: None,
    },
}

Start with the external_docs_doc_url_crate reproduction in crates/ide/src/doc_links/tests.rs and trace the hover request through ide::hover::hover_offset, as shown in the panic stack. Run the test and inspect how the reported offset is used; done means the reproduction no longer panics and the expected documentation URLs still pass.