ICE: StyledBuffer::replace panics 'slice index starts at 12 but ends at 11' when emitting dead-code warning for method with 11+ character name

Summary

rustc 1.95.0 panics in annotate_snippets::renderer::styled_buffer::StyledBuffer::replace when emitting a dead-code warning (check_mod_deathness) for a private method whose name is ≥ 11 characters long, in a large multi-file crate.

Reproduction

The trigger is any private method with an 11+ character name inside an impl block in a crate with many source files. The crash is in the diagnostic renderer, not the analysis itself.

Minimal code pattern that triggers the ICE (in a large crate):

pub struct S;
impl S {
    pub fn new() -> Self { S }
    fn abcdefghijk(&self) {}   // 11-char private method — triggers ICE
    // fn abcdefghij(&self) {} // 10-char — does NOT trigger
}

Note: This does NOT reproduce in a small isolated crate with the same code. A large crate context (many modules, significant source map) appears to be required. Attempts to create a self-contained minimal repro with 25 dummy modules did not reproduce it.

Workaround

None confirmed. CARGO_INCREMENTAL=0 does not prevent the panic.

Full backtrace

thread 'rustc' panicked at library/core/src/slice/index.rs:1031:55:
slice index starts at 12 but ends at 11
stack backtrace:
   0: std::panicking::default_hook::{closure#0}
   1: core::fmt::write
   2: <std::sys::stdio::unix::Stderr as std::io::Write>::write_fmt
   3: std::panicking::default_hook::{closure#0}
   4: std::panicking::default_hook
   5: std::panicking::update_hook::<Box<rustc_driver_impl::install_ice_hook::{closure#1}>>::{closure#0}
   6: std::panicking::panic_with_hook
   7: std::panicking::panic_handler::{closure#0}
   8: std::sys::backtrace::__rust_end_short_backtrace
   9: __rustc::rust_begin_unwind
  10: core::panicking::panic_fmt
  11: core::slice::index::slice_index_fail
  12: <annotate_snippets::renderer::styled_buffer::StyledBuffer>::replace
  13: annotate_snippets::renderer::render::render
  14: <rustc_errors::annotate_snippet_emitter_writer::AnnotateSnippetEmitter>::emit_messages_default
  15: <rustc_errors::annotate_snippet_emitter_writer::AnnotateSnippetEmitter as rustc_errors::emitter::Emitter>::emit_diagnostic
  16: <rustc_errors::DiagCtxtInner>::emit_diagnostic::{closure#3}
  17: rustc_interface::callbacks::track_diagnostic
  18: <rustc_errors::DiagCtxtInner>::emit_diagnostic
  19: <rustc_errors::DiagCtxtHandle>::emit_diagnostic
  20: <() as rustc_errors::diagnostic::EmissionGuarantee>::emit_producing_guarantee
  21: rustc_middle::lint::diag_lint_level::diag_lint_level_impl
  22: <rustc_passes::dead::DeadVisitor>::lint_at_single_level
  23: <rustc_passes::dead::DeadVisitor>::warn_multiple
  24: rustc_passes::dead::check_mod_deathness
  25: rustc_query_impl::execution::try_execute_query::<..check_mod_deathness..>
  26: rustc_query_impl::query_impl::check_mod_deathness::execute_query_non_incr::__rust_end_short_backtrace
  27: rustc_interface::passes::analysis::{closure#0}::{closure#0}::{closure#1}
  28: rustc_data_structures::sync::parallel::par_fns
  29: rustc_interface::passes::analysis
  30: rustc_query_impl::execution::try_execute_query::<..analysis..>
  31: rustc_query_impl::query_impl::analysis::execute_query_non_incr::__rust_end_short_backtrace
  32: rustc_interface::interface::run_compiler

query stack during panic:
#0 [check_mod_deathness] checking deathness of variables in module `universe::proof`
#1 [analysis] running analysis passes on crate `cathedral_armarium`
end of query stack

Notes

• The warn_multiple path (multiple dead items grouped into one diagnostic) is on the call stack. The panic is an inverted byte range in StyledBuffer::replace — start(12) > end(11).
• Renaming the triggering method to ≤ 10 characters removes the ICE.
• The dead-code warning itself is correct; the ICE is only in the renderer.
• CARGO_INCREMENTAL=0 does not help.

Environment

• rustc 1.95.0 (59807616e 2026-04-14)
• platform: x86_64-unknown-linux-gnu
• cargo 1.95.0

Start at annotate_snippets::renderer::styled_buffer::StyledBuffer::replace and follow its caller in annotate_snippets::renderer::render. Reproduce the dead-code warning using the supplied private-method pattern in a sufficiently large multi-file crate, then inspect the inverted byte range reported in the backtrace. Done means the diagnostic renders without a panic for the 11-character method case.