Sema: Coerce base to rvalue when calling a DeclViaBridging overload kind

This code path is only used for a special purpose hack to make
NSString members available on String. Since it is rarely
exercised, it was broken.

Author: slavapestov

lib/Sema/CSApply.cpp

@@ -2555,13 +2555,14 @@ namespace {
       auto selected = *selectedElt;
       switch (selected.choice.getKind()) {
       case OverloadChoiceKind::DeclViaBridge: {
+        base = cs.coerceToRValue(base);
+
         // Look through an implicitly unwrapped optional.
-        auto baseTy = cs.getType(base)->getRValueType();
+        auto baseTy = cs.getType(base);
         if (auto objTy = cs.lookThroughImplicitlyUnwrappedOptionalType(baseTy)){
           base = coerceImplicitlyUnwrappedOptionalToValue(base, objTy,
                                          cs.getConstraintLocator(base));
-
-          baseTy = cs.getType(base)->getRValueType();
+          baseTy = objTy;
         }
 
         auto &tc = cs.getTypeChecker();

test/SILGen/objc_bridging_nsstring.swift

@@ -0,0 +1,17 @@
+// RUN: %empty-directory(%t)
+// RUN: %build-silgen-test-overlays
+// RUN: %target-swift-frontend(mock-sdk: -sdk %S/Inputs -I %t) -Xllvm -sil-full-demangle -emit-silgen %s -enable-sil-ownership
+
+// REQUIRES: objc_interop
+
+import Foundation
+
+extension NSString {
+  var x: Float { return 0.0 }
+}
+
+// note: this has to be a var
+var str: String = "hello world"
+
+// Crash when NSString member is accessed on a String with an lvalue base
+_ = str.x