Dataflow: unexpected receiver type in MethodAccessNode in a subclass

Snippet:

class Super1<T> {
  T methodInner() {
    return null;
  }
}

class Sub1<U> extends Super1<U> {
  U method() {
    return methodInner();
    //      ^------------------- (this).methodInner
  }
}

When superclass's method is invoked in a subclass, the receiver of the method points to superclass' type rather than subclass':

actual:

receiver.type = Super1<T>

expected:

receiver.type = Sub1<U>

This is problematic because I can't use receiver's type to determine if I need to substitute type params in method's type for the subclass.

The same is true for FieldAccessNode.

Start by tracing the MethodAccessNode handling in the Dataflow implementation, then compare it with the related FieldAccessNode behavior described in the issue. Reproduce the generic superclass/subclass example and verify that both nodes expose the subclass receiver type, including the expected type-parameter substitution behavior.