Fix unsoundness bug on next trait solver for dyn const generics placeholder

compiler/rustc_trait_selection/src/traits/wf.rs

@@ -1003,7 +1003,10 @@ impl<'a, 'tcx> TypeVisitor<TyCtxt<'tcx>> for WfPredicates<'a, 'tcx> {
                         let kind = obligation.predicate.kind().skip_binder();
                         let keep = match kind {
                             ty::PredicateKind::Clause(ty::ClauseKind::ConstArgHasType(ct, _))
-                                if matches!(ct.kind(), ty::ConstKind::Param(..)) =>
+                                if matches!(
+                                    ct.kind(),
+                                    ty::ConstKind::Param(..) | ty::ConstKind::Placeholder(..)
+                                ) =>
                             {
                                 // ConstArgHasType clauses are not higher kinded. Assert as
                                 // such so we can fix this up if that ever changes.

tests/ui/const-generics/dyn-trait-ill-typed.rs

@@ -0,0 +1,15 @@
+//! Regression test for <https://github.com/rust-lang/trait-system-refactor-initiative/issues/296>.
+//@ compile-flags: -Znext-solver=globally
+//@ check-fail
+
+// CHECK PASS TO SHOW IT PASSES, BUT IT SHOULD NOT
+// THIS CODE SEGFAULTS, WITH REASON
+
+//~v ERROR: the constant `M` is not of type `usize`
+fn foo<const M: u32>() -> Box<dyn Tr<M>> {
+    loop {}
+}
+
+trait Tr<const N: usize> {}
+
+fn main() {}

tests/ui/const-generics/dyn-trait-ill-typed.stderr

@@ -0,0 +1,14 @@
+error: the constant `M` is not of type `usize`
+  --> $DIR/dyn-trait-ill-typed.rs:9:27
+   |
+LL | fn foo<const M: u32>() -> Box<dyn Tr<M>> {
+   |                           ^^^^^^^^^^^^^^ expected `usize`, found `u32`
+   |
+note: required by a const generic parameter in `Tr`
+  --> $DIR/dyn-trait-ill-typed.rs:13:10
+   |
+LL | trait Tr<const N: usize> {}
+   |          ^^^^^^^^^^^^^^ required by this const generic parameter in `Tr`
+
+error: aborting due to 1 previous error
+