Issue 1:
#![feature(default_type_params)]

pub struct Foo<Bar = Bar>;

pub struct Baz(Foo);

fn main() {}

$ RUST_BACKTRACE=1 rustc foo.rs
foo.rs:5:16: 5:19 error: internal compiler error: Type parameter `Bar` (Bar/TypeSpace/0) out of range when substituting (root type=Bar)
foo.rs:5 pub struct Baz(Foo);
^~~
note: the compiler hit an unexpected failure path. this is a bug.
note: we would appreciate a bug report: http://doc.rust-lang.org/complement-bugreport.html
note: run with `RUST_BACKTRACE=1` for a backtrace
task 'rustc' failed at 'Box<Any>', /Users/rustbuild/src/rust-buildbot/slave/nightly-mac/build/src/libsyntax/diagnostic.rs:113

stack backtrace:
1: 0x10c01dda9 - rt::backtrace::imp::write::h189e19957ab9c695OLq
2: 0x10c021077 - failure::on_fail::h03dc2437e5a88345n2q
3: 0x10c28e395 - unwind::begin_unwind_inner::hf0bc25e3a9312068Jud
4: 0x10b782267 - unwind::begin_unwind::h13550917712925122129
5: 0x10b782200 - unwind::begin_unwind::h13550917712925122129
6: 0x108ef3651 - middle::subst::SubstFolder<'a, 'tcx>.TypeFolder<'tcx>::fold_ty::h51d3eabd2d589326k7U
7: 0x1092dd867 - middle::typeck::astconv::ast_path_substs::h17230674362159792950
8: 0x1092f274a - middle::typeck::astconv::ast_path_to_ty::h9293039141781755470
9: 0x1092da6ad - middle::typeck::astconv::ast_ty_to_ty::h10119988251165278301
10: 0x10932b4c5 - middle::typeck::collect::convert_field::h2da86f9ee62891ddJBf
11: 0x1092f574a - middle::typeck::collect::convert_struct::h2b7ee55df10ef64egtg
12: 0x1092d0f9d - middle::typeck::collect::convert::h31420af36e1b2433Pgg
13: 0x1092cae53 - middle::typeck::collect::collect_item_types::h500e21302badea5eGhf
14: 0x108c47b96 - util::common::time::h17347838844167099674
15: 0x109486e18 - middle::typeck::check_crate::h4a8150eb203da20bLVk
16: 0x1094f1d6f - driver::driver::phase_3_run_analysis_passes::hb45292d67f60c7dbEvx
17: 0x1094ebfb3 - driver::driver::compile_input::hcfe10250ad7929a4qcx
18: 0x109572834 - driver::run_compiler::h3e10e2d15988f082J0A
19: 0x109570966 - driver::run::closure.147488
20: 0x108c612eb - task::TaskBuilder<S>::try_future::closure.101597
21: 0x108c611d3 - task::TaskBuilder<S>::spawn_internal::closure.101568
22: 0x108be379d - task::spawn_opts::closure.8528
23: 0x10c2f595c - rust_try_inner
24: 0x10c2f5946 - rust_try
25: 0x10c28ba07 - unwind::try::h538ab1bff32c8080rjd
26: 0x10c28b88c - task::Task::run::h756ab4c75afdd7bdCzc
27: 0x108be35c2 - task::spawn_opts::closure.8467
28: 0x10c28d24a - thread::thread_start::hf25b5002f28406f0NTc
29: 0x7fff9469c899 - _pthread_body
30: 0x7fff9469c72a - _pthread_struct_init

Issue 2:
This example causes an ICE:

#![feature(default_type_params)]

trait Foo<T=Self> {
fn method(&self);
}

fn foo(x: &Foo) { }

fn main() { }

yields

<anon>:7:12: 7:15 error: internal compiler error: Type parameter `Self/SelfSpace.0` (Self/SelfSpace/0) out of range when substituting (root type=Self) substs=Substs[types=[[];[];[];[]], regions=[[];[];[];[]]]

This is because, in an object type, the self parameter slot is empty, so the substitution of the default fails. I'm not 100% sure what's the best way to fix this. We could make the substitution report a proper error rather than ICE; perhaps that's best.

It is debatable whether such a trait ought to be object safe, but it seems harmless, if pointless, since the Self type winds up being revealed.