[Clang] Clang crashes on certain uses of trailing return type since Clang 18

Reproducing example ([Godbolt link](https://godbolt.org/z/z7Wxbfqeo)):

```C++
template
struct ConstantWrapper {
static constexpr auto value = V;

template
constexpr auto operator()(Ts... args) const -> ConstantWrapper {
return {};
}
};

struct Plus {
template
constexpr auto operator()(T&& t, U&& u) const -> decltype(static_cast(t) + static_cast(u)) {
return static_cast(t) + static_cast(u);
}
};

constexpr auto cwv = ConstantWrapper{}(ConstantWrapper<42>{}, ConstantWrapper<17>{});
```

Error messages:
```
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -std=c++20 -pedantic-errors
1. :18:69: current parser token ','
2. :2:8: instantiating class definition 'ConstantWrapper<42>'
#0 0x0000000004419008 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4419008)
#1 0x0000000004415eb4 llvm::sys::RunSignalHandlers() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4415eb4)
#2 0x00000000044164ec llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x44164ec)
#3 0x0000000004354b78 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
#4 0x00007dc9d6845330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x00007dc9d689ec0c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9ec0c)
#6 0x00007dc9d684527e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#7 0x00007dc9d68288ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#8 0x00007dc9d682881b (/lib/x86_64-linux-gnu/libc.so.6+0x2881b)
#9 0x00007dc9d683b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#10 0x00000000081159a6 clang::CallExpr::getCallReturnType(clang::ASTContext const&) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x81159a6)
#11 0x000000000812251b ClassifyInternal(clang::ASTContext&, clang::Expr const*) ExprClassification.cpp:0:0
#12 0x0000000008123530 clang::Expr::ClassifyImpl(clang::ASTContext&, clang::SourceLocation*) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x8123530)
#13 0x0000000007894807 clang::Sema::DeduceAutoType(clang::TypeLoc, clang::Expr*, clang::QualType&, clang::sema::TemplateDeductionInfo&, bool, bool, clang::TemplateSpecCandidateSet*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7894807)
#14 0x00000000077d24ea clang::Sema::CheckTemplateArgument(clang::NamedDecl*, clang::QualType, clang::Expr*, clang::TemplateArgument&, clang::TemplateArgument&, bool, clang::Sema::CheckTemplateArgumentKind) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x77d24ea)
#15 0x00000000077d4ea5 clang::Sema::CheckTemplateArgument(clang::NamedDecl*, clang::TemplateArgumentLoc&, clang::NamedDecl*, clang::SourceLocation, clang::SourceLocation, unsigned int, clang::Sema::CheckTemplateArgumentInfo&, clang::Sema::CheckTemplateArgumentKind) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x77d4ea5)
#16 0x00000000077da8f9 clang::Sema::CheckTemplateArgumentList(clang::TemplateDecl*, clang::TemplateParameterList*, clang::SourceLocation, clang::TemplateArgumentListInfo&, clang::DefaultArguments const&, bool, clang::Sema::CheckTemplateArgumentInfo&, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x77da8f9)
#17 0x00000000077f1b5f clang::Sema::CheckTemplateIdType(clang::ElaboratedTypeKeyword, clang::TemplateName, clang::SourceLocation, clang::TemplateArgumentListInfo&, clang::Scope*, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x77f1b5f)
#18 0x000000000793edad clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformTemplateSpecializationType(clang::TypeLocBuilder&, clang::TemplateSpecializationTypeLoc, clang::QualType, clang::NamedDecl*, bool) SemaTemplateInstantiate.cpp:0:0
#19 0x000000000791e4ad clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformType(clang::TypeLocBuilder&, clang::TypeLoc) SemaTemplateInstantiate.cpp:0:0
#20 0x0000000007949802 clang::Sema::SubstFunctionDeclType(clang::TypeSourceInfo*, clang::MultiLevelTemplateArgumentList const&, clang::SourceLocation, clang::DeclarationName, clang::CXXRecordDecl*, clang::Qualifiers, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7949802)
#21 0x00000000079a6dfc clang::TemplateDeclInstantiator::SubstFunctionType(clang::FunctionDecl*, llvm::SmallVectorImpl&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x79a6dfc)
#22 0x0000000007a06f59 clang::TemplateDeclInstantiator::VisitCXXMethodDecl(clang::CXXMethodDecl*, clang::TemplateParameterList*, clang::TemplateDeclInstantiator::RewriteKind) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7a06f59)
#23 0x0000000007a0ba3a clang::TemplateDeclInstantiator::VisitFunctionTemplateDecl(clang::FunctionTemplateDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7a0ba3a)
#24 0x00000000079281fb clang::Sema::InstantiateClassImpl(clang::SourceLocation, clang::CXXRecordDecl*, clang::CXXRecordDecl*, clang::MultiLevelTemplateArgumentList const&, clang::TemplateSpecializationKind, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x79281fb)
#25 0x000000000799758f clang::Sema::InstantiateClassTemplateSpecialization(clang::SourceLocation, clang::ClassTemplateSpecializationDecl*, clang::TemplateSpecializationKind, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x799758f)
#26 0x0000000007a1a76e void llvm::function_ref::callback_fn(long) SemaType.cpp:0:0
#27 0x00000000088a3a11 clang::StackExhaustionHandler::runWithSufficientStackSpace(clang::SourceLocation, llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x88a3a11)
#28 0x0000000007a30e5e clang::Sema::RequireCompleteTypeImpl(clang::SourceLocation, clang::QualType, clang::Sema::CompleteTypeKind, clang::Sema::TypeDiagnoser*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7a30e5e)
#29 0x0000000007a312df clang::Sema::RequireCompleteType(clang::SourceLocation, clang::QualType, clang::Sema::CompleteTypeKind, clang::Sema::TypeDiagnoser&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7a312df)
#30 0x00000000073e8fcd clang::Sema::BuildCXXTypeConstructExpr(clang::TypeSourceInfo*, clang::SourceLocation, llvm::MutableArrayRef, clang::SourceLocation, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x73e8fcd)
#31 0x00000000073e96b9 clang::Sema::ActOnCXXTypeConstructExpr(clang::OpaquePtr, clang::SourceLocation, llvm::MutableArrayRef, clang::SourceLocation, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x73e96b9)
#32 0x0000000006e069c6 clang::Parser::ParseCXXTypeConstructExpression(clang::DeclSpec const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e069c6)
#33 0x0000000006def11e clang::Parser::ParseCastExpression(clang::CastParseKind, bool, bool&, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6def11e)
#34 0x0000000006dedba0 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, bool&, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6dedba0)
#35 0x0000000006defbb7 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6defbb7)
#36 0x0000000006defc49 clang::Parser::ParseAssignmentExpression(clang::TypoCorrectionTypeBehavior) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6defc49)
#37 0x0000000006deffa6 clang::Parser::ParseExpressionList(llvm::SmallVectorImpl&, llvm::function_ref, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6deffa6)
#38 0x0000000006df52a0 clang::Parser::ParsePostfixExpressionSuffix(clang::ActionResult) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6df52a0)
#39 0x0000000006ded90a clang::Parser::ParseCastExpression(clang::CastParseKind, bool, bool&, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6ded90a)
#40 0x0000000006dedba0 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, bool&, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6dedba0)
#41 0x0000000006defbb7 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6defbb7)
#42 0x0000000006defc49 clang::Parser::ParseAssignmentExpression(clang::TypoCorrectionTypeBehavior) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6defc49)
#43 0x0000000006e194a0 clang::Parser::ParseInitializer(clang::Decl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e194a0)
#44 0x0000000006da78ef clang::Parser::ParseDeclarationAfterDeclaratorAndAttributes(clang::Declarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6da78ef)
#45 0x0000000006dc7bf9 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6dc7bf9)
#46 0x0000000006d72ceb clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d72ceb)
#47 0x0000000006d734df clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d734df)
#48 0x0000000006d7fff8 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d7fff8)
#49 0x0000000006d80f35 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d80f35)
#50 0x0000000006d5dafa clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d5dafa)
#51 0x0000000004f23558 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f23558)
#52 0x0000000005250138 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x5250138)
#53 0x00000000051ddd3d clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x51ddd3d)
#54 0x00000000053258cd clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x53258cd)
#55 0x0000000000db46ec cc1_main(llvm::ArrayRef, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdb46ec)
#56 0x0000000000dab3ea ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#57 0x0000000000dab56d int llvm::function_ref&)>::callback_fn&)>(long, llvm::SmallVectorImpl&) driver.cpp:0:0
#58 0x0000000004f9be09 void llvm::function_ref::callback_fn>, std::__cxx11::basic_string, std::allocator>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#59 0x0000000004354fb4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4354fb4)
#60 0x0000000004f9c975 clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__cxx11::basic_string, std::allocator>*, bool*) const (.part.0) Job.cpp:0:0
#61 0x0000000004f547f2 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f547f2)
#62 0x0000000004f59157 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f59157)
#63 0x0000000004f63745 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f63745)
#64 0x0000000000db0bda clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdb0bda)
#65 0x0000000000ccc85a main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xccc85a)
#66 0x00007dc9d682a1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#67 0x00007dc9d682a28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#68 0x0000000000daad95 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdaad95)
```

Note that the stacktrace is quite similar to that of #115725.

Reproduce the crash with the provided Godbolt example and Clang’s C++20 options. Start with the stack frames through SemaTemplateInstantiate.cpp, especially template instantiation and SubstFunctionDeclType, then trace the CallExpr::getCallReturnType path. Done means the example no longer crashes and a regression test covers this trailing-return-type case.

Written by the indexing model from the issue text.