fix #26965, allow promotion from type param upper bound in strong mode

pkg/analyzer/lib/src/generated/type_system.dart

 // Copyright (c) 2015, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library analyzer.src.generated.type_system;
 
 import 'dart:collection';
 import 'dart:math' as math;
 
 import 'package:analyzer/dart/ast/token.dart' show TokenType;
@@ skipping 27 matching lines @@
 
   StrongTypeSystemImpl(
       {this.implicitCasts: true,
       this.nonnullableTypes: AnalysisOptionsImpl.NONNULLABLE_TYPES});
 
   bool anyParameterType(FunctionType ft, bool predicate(DartType t)) {
     return ft.parameters.any((p) => predicate(p.type));
   }
 
   @override
-  bool canPromoteToType(DartType to, DartType from) => isSubtypeOf(to, from);
+  bool canPromoteToType(DartType to, DartType from) {
+    // Allow promoting to a subtype, for example:
+    //
+    //     f(Base b) {
+    //       if (b is SubTypeOfBase) {
+    //         // promote `b` to SubTypeOfBase for this block
+    //       }
+    //     }
+    //
+    // This allows the variable to be used wherever the supertype (here `Base`)
+    // is expected, while gaining a more precise type.
+    if (isSubtypeOf(to, from)) {
+      return true;
+    }
+    // For a type parameter `T extends U`, allow promoting from the upper bound
+    // `U` to `S` where `S <: U`.
+    //
+    // This does restrict the variable, because `S </: T`, it can no longer be
+    // used as a `T` without another cast.
+    //
+    // However the members you could access from a variable of type `T`, were
+    // already those on the upper bound `U`. So all members on `U` will be
+    // accessible, as well as those on `S`. Pragmatically this feels like a
+    // useful enough trade-off to allow promotion.
+    //
+    // (In general we would need union types to support this feature precisely.)
+    if (from is TypeParameterType) {
+      return isSubtypeOf(to, from.resolveToBound(DynamicTypeImpl.instance));
+    }
+
+    return false;
+  }
 
   @override
   FunctionType functionTypeToConcreteType(
       TypeProvider typeProvider, FunctionType t) {
     // TODO(jmesserly): should we use a real "fuzzyArrow" bit on the function
     // type? That would allow us to implement this in the subtype relation.
     // TODO(jmesserly): we'll need to factor this differently if we want to
     // move CodeChecker's functionality into existing analyzer. Likely we can
     // let the Expression have a strict arrow, then in places were we do
     // inference, convert back to a fuzzy arrow.
@@ skipping 1489 matching lines @@
 }
 
 bool _isBottom(DartType t, {bool dynamicIsBottom: false}) {
   return (t.isDynamic && dynamicIsBottom) || t.isBottom;
 }
 
 bool _isTop(DartType t, {bool dynamicIsBottom: false}) {
   // TODO(leafp): Document the rules in play here
   return (t.isDynamic && !dynamicIsBottom) || t.isObject;
 }