fix #27382, tweak inference heuristic when we have no upper bound info

pkg/analyzer/lib/src/generated/type_system.dart

 // Copyright (c) 2015, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library analyzer.src.generated.type_system;
 
 import 'dart:collection';
 import 'dart:math' as math;
 
 import 'package:analyzer/dart/ast/ast.dart' show AstNode;
@@ skipping 1586 matching lines @@
         // error spans. But ultimately it's just a heuristic, as the code is
         // already erroneous.
         //
         // (we may adjust the normal heuristic too, once upwards+downwards
         // inference are fully integrated, to prefer downwards info).
         lowerBound = bound.upper;
         upperBound = bound.lower;
       }
 
       inferredTypes[i] =
-          variance.passedIn || lowerBound.isBottom ? upperBound : lowerBound;
+          variance.passedIn && !upperBound.isDynamic || lowerBound.isBottom
+              ? upperBound
+              : lowerBound;
     }
 
     // Return the instantiated type.
     return genericType.instantiate(inferredTypes) as dynamic/*=T*/;
   }
 
   @override
   bool _inferTypeParameterSubtypeOf(
       DartType t1, DartType t2, Set<Element> visited) {
     if (t1 is TypeParameterType) {
@@ skipping 133 matching lines @@
       } else {
         passedOut = true;
       }
     } else if (type is FunctionType) {
       _visitFunctionType(typeParam, type, paramIn);
     } else if (type is InterfaceType) {
       _visitInterfaceType(typeParam, type, paramIn);
     }
   }
 }