[Sema] In simplifyType, if substitution fails retry with IUOs stripped.

lib/Sema/ConstraintSystem.cpp

@@ -1570,6 +1570,10 @@ Type ConstraintSystem::simplifyType(Type type) {
       if (newBase.getPointer() == depMemTy->getBase().getPointer())
         return type;
 
+      // Dependent member types should only be created for associated types.
+      auto assocType = depMemTy->getAssocType();
+      assert(depMemTy->getAssocType());
+
       Type lookupBaseType = newBase->getLValueOrInOutObjectType();
 
       // If the new base is still something we can't handle, just build a
@@ -1582,21 +1586,41 @@ Type ConstraintSystem::simplifyType(Type type) {
           return DependentMemberType::get(newBase, assocType);
       }
 
-      // Dependent member types should only be created for associated types.
-      auto assocType = depMemTy->getAssocType();
-      assert(depMemTy->getAssocType());
-
       if (!lookupBaseType->mayHaveMembers()) return type;
 
       auto result = assocType->getDeclaredInterfaceType()
           .subst(DC->getParentModule(),
                  lookupBaseType->getContextSubstitutions(
                     assocType->getDeclContext()));
 
+      if (result)
+        return result;
+
       // FIXME: Record failure somehow?
-      if (!result) return type;
+      if (!lookupBaseType->getImplicitlyUnwrappedOptionalObjectType())
+        return type;
 
-      return result;
+      // "Force" the IUO for substitution purposes. We can end up in
+      // this situation if we use the results of overload resolution
+      // as a generic type and the overload resolution resulted in an
+      // IUO-typed entity.
+      while (auto objectType =
+             lookupBaseType->getImplicitlyUnwrappedOptionalObjectType()) {
+        lookupBaseType = objectType;
+      }
+
+      if (!lookupBaseType->mayHaveMembers()) return type;
+
+      result = assocType->getDeclaredInterfaceType()
+          .subst(DC->getParentModule(),
+                 lookupBaseType->getContextSubstitutions(
+                    assocType->getDeclContext()));
+
+      if (result)
+        return result;
+
+      // FIXME: Record failure somehow?
+      return type;
     }
 
     // If this is a FunctionType and we inferred new function attributes, apply

test/Constraints/dynamic_lookup.swift

@@ -230,3 +230,20 @@ var anyDict: [String : Any] = Dictionary<String, Any>()
 anyDict["test"] = anyValue
 _ = anyDict["test"]!.bar() // expected-error {{value of type 'Any' has no member 'bar'}}
 // expected-note@-1 {{cast 'Any' to 'AnyObject' or use 'as!' to force downcast to a more specific type to access members}}{{5-5=(}}{{21-21= as AnyObject)}}
+
+// Test that overload resolution during constraint solving of values
+// looked-up dynamically through AnyObject are treated as conforming
+// to the protocols they are supposed to conform to.
+class NSObjDerived1 : NSObject {
+  var everything: [Any] = []
+}
+
+class NSObjDerived2 : NSObject {
+  var everything: Any = 1
+}
+
+func rdar29960565(_ o: AnyObject) {
+  for i in o.everything {
+    _ = i
+  }
+}