Move Null type to the Bottom in the VM (fixes #28025).

runtime/lib/object.cc

Index: runtime/lib/object.cc
diff --git a/runtime/lib/object.cc b/runtime/lib/object.cc
index cc7614b9dd6223c20eea85752cc64b779b262c35..b67da4fa037f0bdcabea15b657ef345491af8e7c 100644
--- a/runtime/lib/object.cc
+++ b/runtime/lib/object.cc
@@ -311,10 +311,8 @@ DEFINE_NATIVE_ENTRY(Object_as, 3) {
   ASSERT(!type.IsMalformed());
   ASSERT(!type.IsMalbounded());
   Error& bound_error = Error::Handle(zone);
-  if (instance.IsNull()) {
-    return instance.raw();
-  }
   const bool is_instance_of =
+      instance.IsNull() ||
       instance.IsInstanceOf(type, instantiator_type_arguments, &bound_error);
   if (FLAG_trace_type_checks) {
     const char* result_str = is_instance_of ? "true" : "false";