This upcast coercion currently preserves the vtable for the object, but
eventually it can be used to create a derived vtable. The upcast
coercion is not introduced into method dispatch; see comment on #18737
for information about why. Fixes#18737.
We already do this for the function arguments, but miss it for the
retslot pointer, which can lead to LLVM assertions because the retslot
has the wrong type.
Fixes#22663