Move Null type to the Bottom in the VM (fixes #28025).

runtime/vm/aot_optimizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/aot_optimizer.h"
 
 #include "vm/bit_vector.h"
 #include "vm/branch_optimizer.h"
 #include "vm/cha.h"
 #include "vm/compiler.h"
@@ skipping 1317 matching lines @@
   const ClassTable& class_table = *isolate()->class_table();
   Bool& prev = Bool::Handle(Z);
   Class& cls = Class::Handle(Z);
 
   bool results_differ = false;
   for (int i = 0; i < ic_data.NumberOfChecks(); i++) {
     cls = class_table.At(ic_data.GetReceiverClassIdAt(i));
     if (cls.NumTypeArguments() > 0) {
       return Bool::null();
     }
+    // As of Dart 1.5, the Null type is a subtype of (and is more specific than)
+    // any type. However, we are checking instances here and not types. The
+    // null instance is only an instance of Null, Object, and dynamic.
     const bool is_subtype =
-        cls.IsSubtypeOf(TypeArguments::Handle(Z), type_class,
-                        TypeArguments::Handle(Z), NULL, NULL, Heap::kOld);
+        cls.IsNullClass()
+            ? (type_class.IsNullClass() || type_class.IsObjectClass() ||
+               type_class.IsDynamicClass())
+            : cls.IsSubtypeOf(TypeArguments::Handle(Z), type_class,
+                              TypeArguments::Handle(Z), NULL, NULL, Heap::kOld);
     results->Add(cls.id());
     results->Add(is_subtype);
     if (prev.IsNull()) {
       prev = Bool::Get(is_subtype).raw();
     } else {
       if (is_subtype != prev.value()) {
         results_differ = true;
       }
     }
   }
@@ skipping 812 matching lines @@
                                   FlowGraph::kEffect);
         current_iterator()->RemoveCurrentFromGraph();
       }
     }
   }
 }
 
 #endif  // DART_PRECOMPILER
 
 }  // namespace dart