anchor.diff:     * Get the inferred concrete return type of [element].
      */
     TypeMask getReturnTypeOfElement(Element element) {
  -    return null;
  +    if (!element.isFunction()) return null;
  +    Map<ConcreteTypesEnvironment, ConcreteType> templates = cache[element];
  +    if (templates == null) return null;
  +    ConcreteType returnType = emptyConcreteType;
  +    templates.forEach((_, concreteType) {
  +      returnType = union(returnType, concreteType);
  +    });
  +    return fromConcreteToTypeMask(returnType);
     }
   
     // --- analysis ---
  
positive.code:    */
    FunctionElement listConstructor;
  
    /**
     * A cache from (function x argument base types) to concrete types,
     * used to memoize [analyzeMonoSend]. Another way of seeing [cache] is as a
  
negative.code: 
    // -- query --
  
    TypeMask fromClassBaseTypeToTypeMask(ClassBaseType baseType) {
      ClassBaseType classBaseType = baseType;
      ClassElement cls = classBaseType.element;
      return new TypeMask.nonNullExact(cls.rawType);
    }
  
    /**
     * Returns the [TypeMask] representation of [concreteType]. Returns [:null:]
     * if and only if [:concreteType.isUnknown():].
     */
    TypeMask fromConcreteToTypeMask(ConcreteType concreteType) {
      if (concreteType == null) return null;
      TypeMask typeMask;
      bool nullable = false;
      for (BaseType baseType in concreteType.baseTypes) {
        if (baseType.isUnknown()) {
          return null;
        } else if (baseType.isNull()) {
          nullable = true;
        } else {
          TypeMask current = fromClassBaseTypeToTypeMask(baseType);
          typeMask = typeMask == null
              ? current
              : typeMask.union(current, compiler);
        }
      }
      return nullable
          ? typeMask == null ? null : typeMask.nullable()
          : typeMask;
    }
  
    /**
  