[CS] Avoid escaping solver-allocated types in computeSubstitutions

Make sure we call `simplifyType` for the opened type bindings to
ensure holes get converted to UnresolvedType.

rdar://154553285

lib/Sema/CSApply.cpp

@@ -116,7 +116,7 @@ Solution::computeSubstitutions(NullablePtr<ValueDecl> decl,
       } else if (!type->is<PackType>())
         type = PackType::getSingletonPackExpansion(type);
     }
-    replacementTypes.push_back(type);
+    replacementTypes.push_back(simplifyType(type));
   }
 
   auto lookupConformanceFn =
@@ -145,9 +145,9 @@ Solution::computeSubstitutions(NullablePtr<ValueDecl> decl,
     return conformance;
   };
 
-  return SubstitutionMap::get(sig,
-                              replacementTypes,
-                              lookupConformanceFn);
+  auto subs = SubstitutionMap::get(sig, replacementTypes, lookupConformanceFn);
+  ASSERT(!subs.getRecursiveProperties().isSolverAllocated());
+  return subs;
 }
 
 // Lazily instantiate function definitions for class template specializations.

test/Constraints/rdar154553285.swift

@@ -0,0 +1,6 @@
+// RUN: %target-typecheck-verify-swift -disable-experimental-parser-round-trip
+
+// Make sure we don't crash
+func testInvalidInInterpolation(_ x: Int) {
+  _ = "\((x, \[]))" // expected-error {{invalid component of Swift key path}}
+}

validation-test/compiler_crashers_2_fixed/4c84d3d852cdd1d4.swift

@@ -0,0 +1,4 @@
+// {"signature":"swift::ProtocolConformanceRef::forAbstract(swift::Type, swift::ProtocolDecl*)"}
+// RUN: not %target-swift-frontend -typecheck %s
+var sixDoubles
+    : Double "six has the value [\( ( sixDoubles \[]) }0 \0\0 \0 \sixDoubles)"

validation-test/compiler_crashers_2_fixed/89bcf379b8d4d092.swift

@@ -0,0 +1,6 @@
+// {"signature":"swift::FunctionType::get(llvm::ArrayRef<swift::AnyFunctionType::Param>, swift::Type, std::__1::optional<swift::ASTExtInfo>)"}
+// RUN: not %target-swift-frontend -typecheck %s
+struct a < b : FixedWidthInteger extension a : Sequence {
+  c {
+    { for
+        d self { b(truncatingIfNeeded : d