Normalize type masks to use the least upper instantiated subclass/type.

pkg/compiler/lib/src/inferrer/simple_types_inferrer.dart

Index: pkg/compiler/lib/src/inferrer/simple_types_inferrer.dart
diff --git a/pkg/compiler/lib/src/inferrer/simple_types_inferrer.dart b/pkg/compiler/lib/src/inferrer/simple_types_inferrer.dart
index 08826d0aa95e9685996e50c9dec55c7d822ae6f2..61f8595ff3abda9e54aa8e54679c6720a49522ad 100644
--- a/pkg/compiler/lib/src/inferrer/simple_types_inferrer.dart
+++ b/pkg/compiler/lib/src/inferrer/simple_types_inferrer.dart
@@ -647,7 +647,19 @@ class SimpleTypeInferrerVisitor<T>
           }
         });
       }
-      returnType = types.nonNullExact(cls);
+      if (analyzedElement.isGenerativeConstructor && cls.isAbstract) {
+        if (compiler.world.isDirectlyInstantiated(cls)) {
+          returnType = types.nonNullExact(cls);
+        } else if (compiler.world.isIndirectlyInstantiated(cls)) {
+          returnType = types.nonNullSubclass(cls);
+        } else  {
+          // TODO(johnniwinther): Avoid analyzing [analyzedElement] in this
+          // case; it's never called.
+          returnType = types.nonNullEmpty();
+        }
+      } else {
+        returnType = types.nonNullExact(cls);
+      }
     } else {
       signature.forEachParameter((LocalParameterElement element) {
         locals.update(element, inferrer.typeOfElement(element), node);