internal compiler error: unexpected lifetime bound

[dwrensha]

I'm seeing an internal compiler error on the following input (found by fuzz-rustc):

$ echo "enum e{A((?'a a+?+l))}" > main.rs
$ rustc main.rs
error: `?` may only modify trait bounds, not lifetime bounds
 --> main.rs:1:11
  |
1 | enum e{A((?'a a+?+l))}
  |           ^

error: expected one of `)`, `+`, or `,`, found `a`
 --> main.rs:1:15
  |
1 | enum e{A((?'a a+?+l))}
  |               ^ expected one of `)`, `+`, or `,`

error: internal compiler error: unexpected lifetime bound
 --> main.rs:1:11
  |
1 | enum e{A((?'a a+?+l))}
  |           ^^^

thread 'rustc' panicked at 'Box<Any>', <::std::macros::panic macros>:2:4
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

note: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/blob/master/CONTRIBUTING.md#bug-reports

note: rustc 1.43.0-nightly (58b834344 2020-02-05) running on x86_64-unknown-linux-gnu

error: aborting due to 3 previous errors

The error happens on nightly and beta but not on stable.

[pnkfelix]

triage : P-medium, removing nomination, adding needs-bisect.

[pnkfelix]

(the bisection here would be entirely automatable if rust-lang/cargo-bisect-rustc#34 were addressed.)

[JohnTitor]

Bisected roughly: ICE occurred from #67505 but not panicked, panicked from #68034

[dwrensha]

#67148 in particular looks suspicious.
cc @Centril

[dwrensha]

Pre-#67148, we return early with an error here:

rust/src/librustc_parse/parser/ty.rs

Line 82 in c64eecf

ts.push(self.parse_ty()?);

Post-#67148, in the corresponding code happens in a call to parse_paren_comma_sep:

rust/src/librustc_parse/parser/ty.rs

Lines 197 to 201 in 1ad6b5e

	let (ts, trailing) = self.parse_paren_comma_seq(|p| {
	let ty = p.parse_ty()?;
	trailing_plus = p.prev_token_kind == PrevTokenKind::Plus;
	Ok(ty)
	})?;

and the parser "recovers" from the error encountered in p.parse_ty()?, allowing this line to be reached:

rust/src/librustc_parse/parser/ty.rs

Line 217 in 1ad6b5e

self.span_bug(ty.span, "unexpected lifetime bound")

.