Fix 2 for object literal type inference

The first attempt in cl/497979576 broke some targets because properties
were dropped from object literals that were expected in other parts of
the code. This fix makes sure that all properties before the spread
operator are added. Note that any properties after the spread operator
are still dropped.

Description of the first fix:

Type inference may visit the same object literal multiple times. If it contains a spread operator, the type of the literal is converted to the global type Object. A subsequent pass over the same literal could later add inferred properties to type Object, which is wrong.

PiperOrigin-RevId: 498473432

Author: mhausner

src/com/google/javascript/jscomp/TypeInference.java

@@ -1802,9 +1802,10 @@ private FlowScope traverseObjectLiteral(Node n, FlowScope scope) {
         // See b/260837012. traverseObjectLiteral() can be invoked multiple times for the same
         // literal. When a spread operator is encountered, the type of the literal is changed to
         // OBJECT_TYPE. A second invocation of this code may then erroneously define new properties
-        // on the global OBJECT_TYPE. So, if there are spread operators in the literal, do not add
-        // newly inferred properties to the type.
-        if (!spreadOperatorSeen) {
+        // on the global OBJECT_TYPE. So, if there are spread operators in the literal and the type
+        // has already been propagated to OBJECT_TYPE, do not add newly inferred properties to the
+        // type.
+        if (!spreadOperatorSeen || !n.getJSType().isNativeObjectType()) {
           objectType.defineInferredProperty(memberName, valueType, key);
         }