fix #30427, casting tearoffs to the wrong type

tests/language_strong/covariant_subtyping_test.dart

 // Copyright (c) 2017, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 import 'package:expect/expect.dart';
 
 bool isTypeError(e) => e is TypeError;
 
 class Fields<T> {
   T x;
   T _y;
@@ skipping 75 matching lines @@
   FnChecks<Object> cObj = cInt;
   Expect.throws(() => cObj.setterForT(), isTypeError);
   Expect.throws(() => (cObj.setterForT() as F<Object>), isTypeError);
   FnChecks<dynamic> cDyn = cInt;
   cDyn.setterForT(); // allowed fuzzy arrow
   Expect.throws(() => cDyn.setterForT()('hi'), isTypeError); // dcall throws
   cInt.setterForT()(42);
   Expect.equals(cObj.getT(), 42);
 }
 
+testTearoffReturningFunctionType() {
+  FnChecks<int> cInt = new FnChecks<int>();
+  FnChecks<Object> cObj = cInt;
+
+  Expect.throws(
+      () => cObj.setterForT, isTypeError, 'unsound tear-off throws at runtime');
+  Expect.equals(cInt.setterForT, cInt.setterForT, 'sound tear-off works');
+}
+
 testFieldOfFunctionType() {
   FnChecks<Object> c = new FnChecks<String>()..f = (String b) {};
   Expect.throws(() {
     F<Object> f = c.f;
   }, isTypeError);
   Expect.throws(() {
     Object f = c.f;
   }, isTypeError);
   Expect.throws(() => c.f, isTypeError);
   Expect.throws(() => c.f(42), isTypeError);
@@ skipping 104 matching lines @@
   Expect.throws(() {
     f(new Object());
   }, isTypeError);
 }
 
 main() {
   testField();
   testPrivateFields();
   testClassBounds();
   testReturnOfFunctionType();
+  testTearoffReturningFunctionType();
   testFieldOfFunctionType();
   testFieldOfGenericFunctionType();
   testMixinApplication();
   testGenericMethodBounds();
   testCallMethod();
 }