[vm, compiler] Fix incorrect reduction of identical(num, num?) to pointer equality.

TEST=ci
Change-Id: Ifd75fa074581cc9c5a67bcc035f0d594b2692158
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/326722
Reviewed-by: Alexander Markov <alexmarkov@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>

runtime/tests/vm/dart/identical_nullable_num_test.dart

@@ -0,0 +1,16 @@
+// Copyright (c) 2023, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// VMOptions=
+// VMOptions=--optimization_level=3
+
+@pragma("vm:never-inline")
+void check(num a, num? b) {
+  if (!identical(a, b)) throw "bad";
+}
+
+main() {
+  // same value, different object, but `identical` is equal for numbers
+  check(0.0, double.parse("0.0"));
+}

runtime/vm/compiler/backend/il.cc

@@ -3367,7 +3367,8 @@ static bool MayBeNumber(CompileType* type) {
   // Note that type 'Number' is a subtype of itself.
   return unwrapped_type.IsTopTypeForSubtyping() ||
          unwrapped_type.IsObjectType() || unwrapped_type.IsTypeParameter() ||
-         unwrapped_type.IsSubtypeOf(Type::Handle(Type::Number()), Heap::kOld);
+         unwrapped_type.IsSubtypeOf(Type::Handle(Type::NullableNumber()),
+                                    Heap::kOld);
 }
 
 // Returns a replacement for a strict comparison and signals if the result has

runtime/vm/object.cc

@@ -2289,6 +2289,8 @@ ErrorPtr Object::Init(IsolateGroup* isolate_group,
     pending_classes.Add(cls);
     type = Type::NewNonParameterizedType(cls);
     object_store->set_number_type(type);
+    type = type.ToNullability(Nullability::kNullable, Heap::kOld);
+    object_store->set_nullable_number_type(type);
 
     cls = Class::New<Instance, RTN::Instance>(kIllegalCid, isolate_group,
                                               /*register_class=*/true,
@@ -21813,6 +21815,10 @@ TypePtr Type::Number() {
   return IsolateGroup::Current()->object_store()->number_type();
 }
 
+TypePtr Type::NullableNumber() {
+  return IsolateGroup::Current()->object_store()->nullable_number_type();
+}
+
 TypePtr Type::StringType() {
   return IsolateGroup::Current()->object_store()->string_type();
 }

runtime/vm/object.h

@@ -9349,6 +9349,9 @@ class Type : public AbstractType {
   // The 'num' type.
   static TypePtr Number();
 
+  // The 'num?' type.
+  static TypePtr NullableNumber();
+
   // The 'String' type.
   static TypePtr StringType();
 

runtime/vm/object_store.h

@@ -82,6 +82,7 @@ class ObjectPointerVisitor;
   RW(Class, closure_class)                                                     \
   RW(Class, record_class)                                                      \
   RW(Type, number_type)                                                        \
+  RW(Type, nullable_number_type)                                               \
   RW(Type, int_type)                                                           \
   RW(Type, legacy_int_type)                                                    \
   RW(Type, non_nullable_int_type)                                              \