Un-shadow object bound candidate in NormalizesTo goal if self_ty is trait object

compiler/rustc_next_trait_solver/src/solve/assembly/mod.rs

@@ -454,7 +454,16 @@ where
                     self.assemble_object_bound_candidates(goal, &mut candidates);
                 }
             }
-            AssembleCandidatesFrom::EnvAndBounds => {}
+            AssembleCandidatesFrom::EnvAndBounds => {
+                // This is somewhat inconsistent and may make #57893 slightly easier to exploit.
+                // However, it matches the behavior of the old solver. See
+                // `tests/ui/traits/next-solver/normalization-shadowing/use_object_if_empty_env.rs`.
+                if matches!(normalized_self_ty.kind(), ty::Dynamic(..))
+                    && !candidates.iter().any(|c| matches!(c.source, CandidateSource::ParamEnv(_)))
+                {
+                    self.assemble_object_bound_candidates(goal, &mut candidates);
+                }
+            }
         }
 
         (candidates, failed_candidate_info)

tests/ui/traits/next-solver/normalization-shadowing/use_object_if_empty_env.rs

@@ -0,0 +1,19 @@
+//@ compile-flags: -Znext-solver
+//@ check-pass
+
+// Regression test for trait-system-refactor-initiative#244
+
+trait Trait {
+    type Assoc;
+}
+
+// We have param env candidate for the trait goal but not the projection.
+// Under such circumstance, consider object candidate if the self_ty is trait object.
+fn foo<T>(x: <dyn Trait<Assoc = T> as Trait>::Assoc) -> T
+where
+    dyn Trait<Assoc = T>: Trait,
+{
+    x
+}
+
+fn main() {}