[ConstraintSystem] Don't attempt dynamic member lookup on invalid base

lib/Sema/CSSimplify.cpp

@@ -4786,6 +4786,10 @@ fixMemberRef(ConstraintSystem &cs, Type baseTy,
     switch (*reason) {
     case MemberLookupResult::UR_InstanceMemberOnType:
     case MemberLookupResult::UR_TypeMemberOnInstance: {
+      if (choice.getKind() == OverloadChoiceKind::DynamicMemberLookup ||
+          choice.getKind() == OverloadChoiceKind::KeyPathDynamicMemberLookup)
+        return nullptr;
+
       return choice.isDecl()
                  ? AllowTypeOrInstanceMember::create(
                        cs, baseTy, choice.getDecl(), memberName, locator)

validation-test/Sema/type_checker_crashers_fixed/rdar48994658.swift

@@ -0,0 +1,28 @@
+// RUN: %target-typecheck-verify-swift
+
+struct Ref<Value> {
+  static func foo(_ value: Int) {} // expected-note {{declared here}}
+}
+
+@dynamicMemberLookup
+protocol RefConvertible {
+  associatedtype Value
+
+  var ref: Ref<Value> { get }
+
+  subscript<T>(dynamicMember keyPath: WritableKeyPath<Value, T>) -> Ref<T> { get }
+}
+
+extension RefConvertible {
+  public subscript<T>(dynamicMember keyPath: WritableKeyPath<Value, T>) -> Ref<T> {
+    return .init()
+  }
+}
+
+extension Ref : RefConvertible {
+  var ref: Ref { return self }
+}
+
+func rdar_48994658() {
+  Ref.foo() // expected-error {{missing argument for parameter #1 in call}}
+}