Move Null type to the Bottom in the VM (fixes #28025).

runtime/vm/aot_optimizer.cc

Index: runtime/vm/aot_optimizer.cc
diff --git a/runtime/vm/aot_optimizer.cc b/runtime/vm/aot_optimizer.cc
index 93501ec22d2a20ce6b26dec3902564d3ff997271..f630aae7fbe44ed635c232d7c57451d04bc590f5 100644
--- a/runtime/vm/aot_optimizer.cc
+++ b/runtime/vm/aot_optimizer.cc
@@ -1335,9 +1335,15 @@ RawBool* AotOptimizer::InstanceOfAsBool(
     if (cls.NumTypeArguments() > 0) {
       return Bool::null();
     }
+    // As of Dart 1.5, the Null type is a subtype of (and is more specific than)
+    // any type. However, we are checking instances here and not types. The
+    // null instance is only an instance of Null, Object, and dynamic.
     const bool is_subtype =
-        cls.IsSubtypeOf(TypeArguments::Handle(Z), type_class,
-                        TypeArguments::Handle(Z), NULL, NULL, Heap::kOld);
+        cls.IsNullClass()
+            ? (type_class.IsNullClass() || type_class.IsObjectClass() ||
+               type_class.IsDynamicClass())
+            : cls.IsSubtypeOf(TypeArguments::Handle(Z), type_class,
+                              TypeArguments::Handle(Z), NULL, NULL, Heap::kOld);
     results->Add(cls.id());
     results->Add(is_subtype);
     if (prev.IsNull()) {