After a dynamic call, refine the receiver type by looking at the potential targets of that call.

tests/compiler/dart2js/value_range_test.dart

Index: tests/compiler/dart2js/value_range_test.dart
===================================================================
--- tests/compiler/dart2js/value_range_test.dart	(revision 22031)
+++ tests/compiler/dart2js/value_range_test.dart	(working copy)
@@ -160,7 +160,7 @@
   // Force [value] to be an int by having the speculative optimizer
   // want an int.
   int sum = 0;
-  for (int i = 0; i < 42; i++) sum += (value & 4);
+  for (int i = 0; i < 42; i++) sum += ~value;
   var a = new List();
   if (value > a.length - 1) return;
   if (value < 0) return;
@@ -174,7 +174,7 @@
   // Force [value] to be an int by having the speculative optimizer
   // want an int.
   int sum = 0;
-  for (int i = 0; i < 42; i++) sum += (value & 4);
+  for (int i = 0; i < 42; i++) sum += ~value;
   var a = new List();
   if (value <= a.length - 1) {
     if (value >= 0) {
@@ -189,7 +189,7 @@
   // Force [value] to be an int by having the speculative optimizer
   // want an int.
   int sum = 0;
-  for (int i = 0; i < 42; i++) sum += (value & 4);
+  for (int i = 0; i < 42; i++) sum += ~value;
   var a = new List();
   if (value >= a.length) return;
   if (value <= -1) return;
@@ -253,6 +253,7 @@
     operator <=(other) {}
     operator >=(other) {}
     operator ==(other) {}
+    operator~() {}
   }
   class JSInt extends JSNumber {
   }