[nullability] Switch to preferred `runDataflowAnalysis()` overload.

The documentation states that the overload taking `CFGEltCallbacks` is
preferred.

PiperOrigin-RevId: 657196000
Change-Id: I7e527de19152ec3a80fc926a87d2e312c637ad12
diff --git a/bazel/llvm.bzl b/bazel/llvm.bzl
index 898d768..678cda1 100644
--- a/bazel/llvm.bzl
+++ b/bazel/llvm.bzl
@@ -53,7 +53,7 @@
             executable = False,
         )
 
-LLVM_COMMIT_SHA = "51d4980a133db12888207698e39c469cb7055cac"
+LLVM_COMMIT_SHA = "99bb9a719cec9513e72ad275c1c0302b76b6c408"
 
 def llvm_loader_repository_dependencies():
     # This *declares* the dependency, but it won't actually be *downloaded* unless it's used.
diff --git a/nullability/test/nullability_test.cc b/nullability/test/nullability_test.cc
index f7c9209..ef74d79 100644
--- a/nullability/test/nullability_test.cc
+++ b/nullability/test/nullability_test.cc
@@ -333,13 +333,15 @@
   dataflow::Environment Env(DACtx, Func);
   PointerNullabilityAnalysis Analysis(Ctx, Env, Pragmas);
   auto Symbolic = bindSymbolicNullability(Func, Analysis, DACtx.arena());
-  require(
-      runDataflowAnalysis(ACFG, Analysis, std::move(Env),
-                          [&](const CFGElement &Elt, AnalysisState &State) {
-                            if (auto CS = Elt.getAs<CFGStmt>())
-                              if (auto *CE = dyn_cast<CallExpr>(CS->getStmt()))
-                                diagnoseCall(*CE, Ctx, Diags, State, Symbolic);
-                          }));
+  dataflow::CFGEltCallbacks<PointerNullabilityAnalysis> PostAnalysisCallbacks;
+  PostAnalysisCallbacks.After = [&](const CFGElement &Elt,
+                                    AnalysisState &State) {
+    if (auto CS = Elt.getAs<CFGStmt>())
+      if (auto *CE = dyn_cast<CallExpr>(CS->getStmt()))
+        diagnoseCall(*CE, Ctx, Diags, State, Symbolic);
+  };
+  require(runDataflowAnalysis(ACFG, Analysis, std::move(Env),
+                              PostAnalysisCallbacks));
 }
 
 // Absorbs test start/end events and diagnostics.