Analyzer summary type logic doesn't do downward type inference

[stereotype441]

Consider the following code:

T f<T>(T x) => x;
var x = [1].map(f);

The correct type to infer for x is Iterable<int>. As of 28cdeb3, the analyzer summary logic infers Iterable<dynamic>. The reason this happens is that the analyzer summary logic doesn't do downward inference at all; it only does upward inference. So the type of f in map(f) is assumed to be (dynamic) -> dynamic, and therefore the return type of the map call is inferred to be Iterable<dynamic>.

[stereotype441]

Unfortunately this is going to be non-trivial to fix because the summary representation of expressions is a postfix representation. In order to push type information both upwards and downwards we'll need to deserialize to a temporary tree representation. Hopefully we can use analyzer ASTs as the temporary representation, so that we can re-use as much of the existing type inference logic as possible. I'll start looking into this today.

[stereotype441]

This was accidentally auto-closed due to the phrase "as part of fixing #X" being misinterpreted by the auto-closer as meaning that the commit fixed the bug.

[stereotype441]

In order to complete this we're going to need to fill in the rest of the implementation of ConstExprBuilder so that it can handle the types of subexpressions that appear outside of constants. I've filed #32674 to track this.