Funny upper bound computed with the iterable of a 'for-in' statement

[eernstg]

Consider the following example:

void main() {
  for (var _ in ([] as Object)) {} // Error.
}

This incurs the compile-time error "The type 'Object' used in the 'for' loop must implement 'Iterable'". That's fine. However consider this variant:

void main() {
  final List<int>? list = [];
  for (var v in list ?? {}) {
    v.expectStaticType<Exactly<Object?>>();
    v.argleBargle; // Error shows `v` does not have type `dynamic`.
    var w = list ?? {};
    bool b = w; // Error message says `w` has type 'Object'.
  }
}

typedef Exactly<X> = X Function(X);
extension<X> on X { X expectStaticType<Y extends Exactly<X>>() => this; }

If v does indeed have the inferred declared type Object? then the iterable list ?? {} should be inferred to a type that implements Iterable<Object?>. However, I'd expect the standard upper bound of List<int> and Set<T> where T is any type except int to be Object, not Iterable<Object?>. So I'd expect an error in the for statement, just like the one we got in the first example.

I know the inference of ?? is tricky, so I may well have gotten something wrong, but other than that I do think it looks like a bug.