Move Null type to the Bottom in the VM (fixes #28025).

runtime/vm/flow_graph_compiler_ia32.cc

Index: runtime/vm/flow_graph_compiler_ia32.cc
diff --git a/runtime/vm/flow_graph_compiler_ia32.cc b/runtime/vm/flow_graph_compiler_ia32.cc
index fbc891ea0969355d6d23ca36eb9940e5f5dbad65..d679be95f77c7ddf3b5485bd1b41324c9b7cffdd 100644
--- a/runtime/vm/flow_graph_compiler_ia32.cc
+++ b/runtime/vm/flow_graph_compiler_ia32.cc
@@ -554,7 +554,7 @@ RawSubtypeTestCache* FlowGraphCompiler::GenerateInlineInstanceof(
 
 // If instanceof type test cannot be performed successfully at compile time and
 // therefore eliminated, optimize it by adding inlined tests for:
-// - NULL -> return false.
+// - NULL -> return type == Null (type is not Object or dynamic).
 // - Smi -> compile time subtype check (only if dst class is not parameterized).
 // - Class equality (only if class is not parameterized).
 // Inputs:
@@ -569,6 +569,7 @@ void FlowGraphCompiler::GenerateInstanceOf(TokenPosition token_pos,
                                            bool negate_result,
                                            LocationSummary* locs) {
   ASSERT(type.IsFinalized() && !type.IsMalformedOrMalbounded());
+  ASSERT(!type.IsObjectType() && !type.IsDynamicType());
 
   const Immediate& raw_null =
       Immediate(reinterpret_cast<intptr_t>(Object::null()));
@@ -577,13 +578,13 @@ void FlowGraphCompiler::GenerateInstanceOf(TokenPosition token_pos,
   // If type is instantiated and non-parameterized, we can inline code
   // checking whether the tested instance is a Smi.
   if (type.IsInstantiated()) {
-    // A null object is only an instance of Object and dynamic, which has
-    // already been checked above (if the type is instantiated). So we can
-    // return false here if the instance is null (and if the type is
-    // instantiated).
+    // A null object is only an instance of Null, Object, and dynamic.
+    // Object and dynamic have already been checked above (if the type is
+    // instantiated). So we can return false here if the instance is null,
+    // unless the type is Null (and if the type is instantiated).
     // We can only inline this null check if the type is instantiated at compile
-    // time, since an uninstantiated type at compile time could be Object or
-    // dynamic at run time.
+    // time, since an uninstantiated type at compile time could be Null, Object,
+    // or dynamic at run time.
     __ cmpl(EAX, raw_null);
     __ j(EQUAL, type.IsNullType() ? &is_instance : &is_not_instance);
   }