Never-bounded types cause CFE crash

[stereotype441]

The following program is accepted by the analyzer, but crashes the CFE:

void f<T extends Never>(T t) {
  t.f();
}

main() {}

The CFE stack trace looks like this:

#0      InferenceVisitorBase.inferMethodInvocation (package:front_end/src/type_inference/inference_visitor_base.dart:3182:26)
#1      InferenceVisitorImpl.visitMethodInvocation (package:front_end/src/type_inference/inference_visitor.dart:4798:12)
#2      MethodInvocation.acceptInference (package:front_end/src/kernel/internal_ast.dart:2809:20)
#3      InferenceVisitorImpl._inferExpression (package:front_end/src/type_inference/inference_visitor.dart:279:27)
#4      InferenceVisitorImpl.inferExpression (package:front_end/src/type_inference/inference_visitor.dart:313:40)
#5      InferenceVisitorImpl.visitExpressionStatement (package:front_end/src/type_inference/inference_visitor.dart:1340:40)
#6      ExpressionStatement.accept (package:kernel/ast.dart:9128:43)
#7      InferenceVisitorImpl.inferStatement (package:front_end/src/type_inference/inference_visitor.dart:264:26)
#8      InferenceVisitorImpl._visitStatements (package:front_end/src/type_inference/inference_visitor.dart:879:50)
#9      InferenceVisitorImpl.visitBlock (package:front_end/src/type_inference/inference_visitor.dart:900:31)
#10     Block.accept (package:kernel/ast.dart:9181:43)
#11     InferenceVisitorImpl.inferStatement (package:front_end/src/type_inference/inference_visitor.dart:264:26)
#12     TypeInferrerImpl.inferFunctionBody (package:front_end/src/type_inference/type_inferrer.dart:183:17)
#13     BodyBuilder.finishFunction (package:front_end/src/kernel/body_builder.dart:1406:43)

As far as I can tell, what's happening is that InferenceVisitorBase.findInterfaceMember determines that the receiver type is bounded by Never, and therefore it classifies the invocation as ObjectAccessTargetKind.never. This causes InferenceVisitorBase.inferMethodInvocation to defer type analysis to InferenceVisitorBase._inferNeverInvocation. The declaration of InferenceVisitorBase._inferNeverInvocation requires that the receiver type be an instance of NeverType, so InferenceVisitorBase.inferMethodInvocation tries to cast it. But the cast fails, because the receiver type isn't Never, it's a type variable whose bound is Never.