Model array loads from null arrays as pushing null

Fixes: b/236551852
Change-Id: I61b2cc4eaff89a80bebb73869c58cbcd600aa8fe
diff --git a/src/main/java/com/android/tools/r8/cf/code/CfArrayLoad.java b/src/main/java/com/android/tools/r8/cf/code/CfArrayLoad.java
index 3d0ab0b..0bae2fd 100644
--- a/src/main/java/com/android/tools/r8/cf/code/CfArrayLoad.java
+++ b/src/main/java/com/android/tools/r8/cf/code/CfArrayLoad.java
@@ -4,6 +4,7 @@
 package com.android.tools.r8.cf.code;
 
 import com.android.tools.r8.cf.CfPrinter;
+import com.android.tools.r8.cf.code.frame.FrameType;
 import com.android.tools.r8.errors.Unreachable;
 import com.android.tools.r8.graph.AppView;
 import com.android.tools.r8.graph.CfCode;
@@ -111,13 +112,17 @@
             appView,
             config,
             getExpectedArrayType(dexItemFactory),
-            (state, head) ->
-                head.isNullType()
-                    ? state.push(appView, config, getType())
-                    : state.push(
-                        config,
-                        head.asInitializedReferenceType()
-                            .getInitializedType()
-                            .toArrayElementType(dexItemFactory)));
+            (state, head) -> {
+              if (head.isNullType()) {
+                return getType() == MemberType.OBJECT
+                    ? state.push(config, FrameType.initialized(DexItemFactory.nullValueType))
+                    : state.push(appView, config, getType());
+              }
+              return state.push(
+                  config,
+                  head.asInitializedReferenceType()
+                      .getInitializedType()
+                      .toArrayElementType(dexItemFactory));
+            });
   }
 }