Sema::ActOnInstanceMessage is generally doing bad things with typedefs, but

here I fix just one.  The loop that rips through pointers should use
getAsPointerType() not static_cast<PointerType*> to get the pointee.  This
fixes a crash on a large testcase.

llvm-svn: 46632