Move Null type to the Bottom in the VM (fixes #28025).

runtime/vm/flow_graph_compiler_arm64.cc

 // Copyright (c) 2014, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_ARM64.
 #if defined(TARGET_ARCH_ARM64)
 
 #include "vm/flow_graph_compiler.h"
 
 #include "vm/ast_printer.h"
@@ skipping 525 matching lines @@
       return SubtypeTestCache::null();
     }
   }
   return GenerateUninstantiatedTypeTest(token_pos, type, is_instance_lbl,
                                         is_not_instance_lbl);
 }
 
 
 // If instanceof type test cannot be performed successfully at compile time and
 // therefore eliminated, optimize it by adding inlined tests for:
-// - NULL -> return false.
+// - NULL -> return type == Null (type is not Object or dynamic).
 // - Smi -> compile time subtype check (only if dst class is not parameterized).
 // - Class equality (only if class is not parameterized).
 // Inputs:
 // - R0: object.
 // - R1: instantiator type arguments or raw_null.
 // Returns:
 // - true or false in R0.
 void FlowGraphCompiler::GenerateInstanceOf(TokenPosition token_pos,
                                            intptr_t deopt_id,
                                            const AbstractType& type,
                                            bool negate_result,
                                            LocationSummary* locs) {
   ASSERT(type.IsFinalized() && !type.IsMalformed() && !type.IsMalbounded());
+  ASSERT(!type.IsObjectType() && !type.IsDynamicType());
 
   // Preserve instantiator type arguments (R1).
   __ Push(R1);
 
   Label is_instance, is_not_instance;
   // If type is instantiated and non-parameterized, we can inline code
   // checking whether the tested instance is a Smi.
   if (type.IsInstantiated()) {
-    // A null object is only an instance of Object and dynamic, which has
-    // already been checked above (if the type is instantiated). So we can
-    // return false here if the instance is null (and if the type is
-    // instantiated).
+    // A null object is only an instance of Null, Object, and dynamic.
+    // Object and dynamic have already been checked above (if the type is
+    // instantiated). So we can return false here if the instance is null,
+    // unless the type is Null (and if the type is instantiated).
     // We can only inline this null check if the type is instantiated at compile
-    // time, since an uninstantiated type at compile time could be Object or
-    // dynamic at run time.
+    // time, since an uninstantiated type at compile time could be Null, Object,
+    // or dynamic at run time.
     __ CompareObject(R0, Object::null_object());
     __ b(type.IsNullType() ? &is_instance : &is_not_instance, EQ);
   }
 
   // Generate inline instanceof test.
   SubtypeTestCache& test_cache = SubtypeTestCache::ZoneHandle(zone());
   test_cache =
       GenerateInlineInstanceof(token_pos, type, &is_instance, &is_not_instance);
 
   // test_cache is null if there is no fall-through.
@@ skipping 1269 matching lines @@
 void ParallelMoveResolver::RestoreFpuScratch(FpuRegister reg) {
   __ PopDouble(reg);
 }
 
 
 #undef __
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_ARM64