Sema: Fix bug in buildMemberRef() with subclass existentials

Make sure we use the right 'self' type in various places. When
calling a Self-returning class method on a subclass existential,
the following has to happen correctly:

- The existential is opened to produce an archetype with a superclass
  constraint.

- The archetype is upcast to a class type to produce the 'self'
  parameter for the call.

- The method call returns a value with the same type as the 'self'
  parameter.

- The return value is downcast to the opened archetype.

- The opened archetype is converted back to an existential.

Some SILGen tests in an upcoming patch exercise this code path.

Author: slavapestov

lib/Sema/CSApply.cpp

@@ -752,6 +752,7 @@ namespace {
 
       bool isSuper = base->isSuperExpr();
 
+      // The formal type of the 'self' value for the call.
       Type baseTy = cs.getType(base)->getRValueType();
 
       // Explicit member accesses are permitted to implicitly look
@@ -801,12 +802,15 @@ namespace {
                                                          cs.getType(ref)));
       }
 
-      // Produce a reference to the type of the container the member
-      // resides in.
+      // The formal type of the 'self' value for the member's declaration.
       Type containerTy =
           refTy->castTo<FunctionType>()
               ->getInput()->getRValueInstanceType();
 
+      // If we have an opened existential, selfTy and baseTy will both be
+      // the same opened existential type.
+      Type selfTy = containerTy;
+
       // If we opened up an existential when referencing this member, update
       // the base accordingly.
       auto knownOpened = solution.OpenedExistentialTypes.find(
@@ -816,7 +820,7 @@ namespace {
       if (knownOpened != solution.OpenedExistentialTypes.end()) {
         base = openExistentialReference(base, knownOpened->second, member);
         baseTy = knownOpened->second;
-        containerTy = baseTy;
+        selfTy = baseTy;
         openedExistential = true;
       }
 
@@ -852,17 +856,18 @@ namespace {
 
         // If the base is already an lvalue with the right base type, we can
         // pass it as an inout qualified type.
-        Type selfTy = containerTy;
+        auto selfParamTy = selfTy;
+
         if (selfTy->isEqual(baseTy))
           if (cs.getType(base)->is<LValueType>())
-            selfTy = InOutType::get(selfTy);
+            selfParamTy = InOutType::get(selfTy);
         base = coerceObjectArgumentToType(
-                 base, selfTy, member, semantics,
+                 base, selfParamTy, member, semantics,
                  locator.withPathElement(ConstraintLocator::MemberRefBase));
       } else {
         // Convert the base to an rvalue of the appropriate metatype.
         base = coerceToType(base,
-                            MetatypeType::get(containerTy),
+                            MetatypeType::get(selfTy),
                             locator.withPathElement(
                               ConstraintLocator::MemberRefBase));
         if (!base)
@@ -6554,9 +6559,6 @@ Expr *ExprRewriter::finishApply(ApplyExpr *apply, Type openedType,
     Expr *result = tc.substituteInputSugarTypeForResult(apply);
     cs.cacheExprTypes(result);
 
-    // Try closing the existential, if there is one.
-    closeExistential(result, locator);
-
     // If we have a covariant result type, perform the conversion now.
     if (covariantResultType) {
       if (covariantResultType->is<FunctionType>())
@@ -6567,6 +6569,9 @@ Expr *ExprRewriter::finishApply(ApplyExpr *apply, Type openedType,
             result, covariantResultType));
     }
 
+    // Try closing the existential, if there is one.
+    closeExistential(result, locator);
+
     // Extract all arguments.
     auto *CEA = arg;
     if (auto *TSE = dyn_cast<TupleShuffleExpr>(CEA))