Move Null type to the Bottom in the VM (fixes #28025).

runtime/vm/flow_graph_compiler_x64.cc

Index: runtime/vm/flow_graph_compiler_x64.cc
diff --git a/runtime/vm/flow_graph_compiler_x64.cc b/runtime/vm/flow_graph_compiler_x64.cc
index 0944b5e58255808ac1e74c3d3ef734f1ef2e06eb..01b4c08f57aaf64b5067c84789076d93f2d4a029 100644
--- a/runtime/vm/flow_graph_compiler_x64.cc
+++ b/runtime/vm/flow_graph_compiler_x64.cc
@@ -549,7 +549,7 @@ RawSubtypeTestCache* FlowGraphCompiler::GenerateInlineInstanceof(
 
 // If instanceof type test cannot be performed successfully at compile time and
 // therefore eliminated, optimize it by adding inlined tests for:
-// - NULL -> return false.
+// - NULL -> return type == Null (type is not Object or dynamic).
 // - Smi -> compile time subtype check (only if dst class is not parameterized).
 // - Class equality (only if class is not parameterized).
 // Inputs:
@@ -564,19 +564,20 @@ void FlowGraphCompiler::GenerateInstanceOf(TokenPosition token_pos,
                                            bool negate_result,
                                            LocationSummary* locs) {
   ASSERT(type.IsFinalized() && !type.IsMalformedOrMalbounded());
+  ASSERT(!type.IsObjectType() && !type.IsDynamicType());
 
   Label is_instance, is_not_instance;
   __ pushq(RDX);  // Store instantiator type arguments.
   // If type is instantiated and non-parameterized, we can inline code
   // checking whether the tested instance is a Smi.
   if (type.IsInstantiated()) {
-    // A null object is only an instance of Object and dynamic, which has
-    // already been checked above (if the type is instantiated). So we can
-    // return false here if the instance is null (and if the type is
-    // instantiated).
+    // A null object is only an instance of Null, Object, and dynamic.
+    // Object and dynamic have already been checked above (if the type is
+    // instantiated). So we can return false here if the instance is null,
+    // unless the type is Null (and if the type is instantiated).
     // We can only inline this null check if the type is instantiated at compile
-    // time, since an uninstantiated type at compile time could be Object or
-    // dynamic at run time.
+    // time, since an uninstantiated type at compile time could be Null, Object,
+    // or dynamic at run time.
     __ CompareObject(RAX, Object::null_object());
     __ j(EQUAL, type.IsNullType() ? &is_instance : &is_not_instance);
   }