In several places, we construct a SubstitutionMap by taking
generic parameters from one SubstitutionMap up to a certain
depth, with the rest coming from a second SubstitutionMap.
Factor this out into a new utility method, to help with
hiding the internal representation of SubstitutionMap from
clients.
This was meant to be NFC, but it actually fixes a crash in
the devirtualizer, because the old logic there was slightly
wrong, so I added a test for this.