Merge branch 'john/compiler/validator-type-conflict-fix/ERL-867'

* john/compiler/validator-type-conflict-fix/ERL-867:
  beam_validator: Express test_arity/is_tagged_tuple as type tests
  beam_validator: Fix type subtraction on select_* and inequality
  beam_validator: Style fix for asserts in list comprehensions
  beam_validator: Infer types from bs_put instructions
  beam_validator: is_map no longer needs special treatment
  beam_validator: Refactor type conflict resolution
  beam_validator: Refactor branch handling
  beam_validator: Fix element/2 BIF handling
  beam_validator: Rename get_move_term_type and clean up get_raw_type

4 files changed, 451 insertions, 284 deletions

diff --git a/lib/compiler/src/beam_validator.erl b/lib/compiler/src/beam_validator.erl
index 296c095be2..ab8caa1a0d 100644
--- a/lib/compiler/src/beam_validator.erl
+++ b/lib/compiler/src/beam_validator.erl
@@ -579,7 +579,11 @@ valfun_1({get_tuple_element,Src,N,Dst}, Vst) ->
     Type = get_element_type(Index, Src, Vst),
     extract_term(Type, {bif,element}, [Index, Src], Dst, Vst);
 valfun_1({jump,{f,Lbl}}, Vst) ->
-    kill_state(branch_state(Lbl, Vst));
+    branch(Lbl, Vst,
+           fun(SuccVst) ->
+                   %% The next instruction is never executed.
+                   kill_state(SuccVst)
+           end);
 valfun_1(I, Vst) ->
     valfun_2(I, Vst).
 
@@ -589,14 +593,17 @@ init_try_catch_branch(Tag, Dst, Fail, Vst0) ->
     St = St0#st{ct=[[Fail]|Fails]},
     Vst = Vst0#vst{current=St},
 
-    complex_test(Fail,
-                 fun(CatchVst) ->
-                          #vst{current=#st{ys=Ys}} = CatchVst,
-                          maps:fold(fun init_catch_handler_1/3, CatchVst, Ys)
-                 end,
-                 fun(SuccVst) ->
-                          SuccVst
-                 end, Vst).
+    branch(Fail, Vst,
+           fun(CatchVst) ->
+                    #vst{current=#st{ys=Ys}} = CatchVst,
+                    maps:fold(fun init_catch_handler_1/3, CatchVst, Ys)
+           end,
+           fun(SuccVst) ->
+                    %% All potentially-throwing instructions after this
+                    %% one will implicitly branch to the fail label;
+                    %% see valfun_2/2
+                    SuccVst
+           end).
 
 %% Set the initial state at the try/catch label. Assume that Y registers
 %% contain terms or try/catch tags.
@@ -607,21 +614,27 @@ init_catch_handler_1(Reg, uninitialized, Vst) ->
 init_catch_handler_1(_, _, Vst) ->
     Vst.
 
-%% Update branched state if necessary and try next set of instructions.
-valfun_2(I, #vst{current=#st{ct=[]}}=Vst) ->
-    valfun_3(I, Vst);
 valfun_2(I, #vst{current=#st{ct=[[Fail]|_]}}=Vst) when is_integer(Fail) ->
-    %% Update branched state.
+    %% We have an active try/catch tag and we can jump there from this
+    %% instruction, so we need to update the branched state of the try/catch
+    %% handler.
     valfun_3(I, branch_state(Fail, Vst));
+valfun_2(I, #vst{current=#st{ct=[]}}=Vst) ->
+    valfun_3(I, Vst);
 valfun_2(_, _) ->
     error(ambiguous_catch_try_state).
 
 %% Handle the remaining floating point instructions here.
 %% Floating point.
-valfun_3({fconv,Src,{fr,_}=Dst}, Vst0) ->
-    assert_term(Src, Vst0),
-    Vst = update_type(fun meet/2, number, Src, Vst0),
-    set_freg(Dst, Vst);
+valfun_3({fconv,Src,{fr,_}=Dst}, Vst) ->
+    assert_term(Src, Vst),
+
+    %% An exception is raised on error, hence branching to 0.
+    branch(0, Vst,
+           fun(SuccVst0) ->
+               SuccVst = update_type(fun meet/2, number, Src, SuccVst0),
+               set_freg(Dst, SuccVst)
+           end);
 valfun_3({bif,fadd,_,[_,_]=Ss,Dst}, Vst) ->
     float_op(Ss, Dst, Vst);
 valfun_3({bif,fdiv,_,[_,_]=Ss,Dst}, Vst) ->
@@ -682,67 +695,87 @@ valfun_4({call_ext_last,_,_,_}, #vst{current=#st{numy=NumY}}) ->
 valfun_4({make_fun2,_,_,_,Live}, Vst) ->
     call(make_fun, Live, Vst);
 %% Other BIFs
-valfun_4({bif,element,{f,Fail},[Pos,Tuple],Dst}, Vst0) ->
-    PosType = get_term_type(Pos, Vst0),
-    ElementType = get_element_type(PosType, Tuple, Vst0),
-    InferredType = {tuple,[get_tuple_size(PosType)],#{}},
-    Vst1 = branch_state(Fail, Vst0),
-    Vst2 = update_type(fun meet/2, InferredType, Tuple, Vst1),
-    Vst = update_type(fun meet/2, {integer,[]}, Pos, Vst2),
-    extract_term(ElementType, {bif,element}, [Pos,Tuple], Dst, Vst);
+valfun_4({bif,element,{f,Fail},[Pos,Src],Dst}, Vst) ->
+    branch(Fail, Vst,
+           fun(SuccVst0) ->
+                   PosType = get_term_type(Pos, SuccVst0),
+                   TupleType = {tuple,[get_tuple_size(PosType)],#{}},
+
+                   SuccVst1 = update_type(fun meet/2, TupleType,
+                                         Src, SuccVst0),
+                   SuccVst = update_type(fun meet/2, {integer,[]},
+                                         Pos, SuccVst1),
+
+                   ElementType = get_element_type(PosType, Src, SuccVst),
+                   extract_term(ElementType, {bif,element}, [Pos,Src],
+                                Dst, SuccVst)
+           end);
 valfun_4({bif,raise,{f,0},Src,_Dst}, Vst) ->
     validate_src(Src, Vst),
     kill_state(Vst);
 valfun_4(raw_raise=I, Vst) ->
     call(I, 3, Vst);
-valfun_4({bif,Op,{f,Fail},[Cons]=Ss,Dst}, Vst0)
-  when Op =:= hd; Op =:= tl ->
-    validate_src(Ss, Vst0),
-    Vst = type_test(Fail, cons, Cons, Vst0),
-    Type = bif_return_type(Op, Ss, Vst),
-    extract_term(Type, {bif,Op}, Ss, Dst, Vst);
-valfun_4({bif,Op,{f,Fail},Ss,Dst}, Vst0) ->
-    validate_src(Ss, Vst0),
-    Vst1 = branch_state(Fail, Vst0),
-
-    %% Infer argument types. Note that we can't type_test in the general case
-    %% as the BIF could fail for reasons other than bad argument types.
-    ArgTypes = bif_arg_types(Op, Ss),
-    Vst = foldl(fun({Arg, T}, Vsti) ->
-                        update_type(fun meet/2, T, Arg, Vsti)
-                end, Vst1, zip(Ss, ArgTypes)),
-
-    Type = bif_return_type(Op, Ss, Vst),
-    extract_term(Type, {bif,Op}, Ss, Dst, Vst);
+valfun_4({bif,Op,{f,Fail},[Src]=Ss,Dst}, Vst) when Op =:= hd; Op =:= tl ->
+    assert_term(Src, Vst),
+    branch(Fail, Vst,
+           fun(FailVst) ->
+                   update_type(fun subtract/2, cons, Src, FailVst)
+           end,
+           fun(SuccVst0) ->
+                   SuccVst = update_type(fun meet/2, cons, Src, SuccVst0),
+                   extract_term(term, {bif,Op}, Ss, Dst, SuccVst)
+           end);
+valfun_4({bif,Op,{f,Fail},Ss,Dst}, Vst) ->
+    validate_src(Ss, Vst),
+    branch(Fail, Vst,
+           fun(SuccVst0) ->
+                   %% Infer argument types. Note that we can't subtract
+                   %% types as the BIF could fail for reasons other than
+                   %% bad argument types.
+                   ArgTypes = bif_arg_types(Op, Ss),
+                   SuccVst = foldl(fun({Arg, T}, V) ->
+                                           update_type(fun meet/2, T, Arg, V)
+                                   end, SuccVst0, zip(Ss, ArgTypes)),
+                   Type = bif_return_type(Op, Ss, SuccVst),
+                   extract_term(Type, {bif,Op}, Ss, Dst, SuccVst)
+           end);
 valfun_4({gc_bif,Op,{f,Fail},Live,Ss,Dst}, #vst{current=St0}=Vst0) ->
     validate_src(Ss, Vst0),
     verify_live(Live, Vst0),
     verify_y_init(Vst0),
+
+    %% Heap allocations and X registers are killed regardless of whether we
+    %% fail or not, as we may fail after GC.
     St = kill_heap_allocation(St0),
-    Vst1 = Vst0#vst{current=St},
-    Vst2 = branch_state(Fail, Vst1),
+    Vst = prune_x_regs(Live, Vst0#vst{current=St}),
+
+    branch(Fail, Vst,
+           fun(SuccVst0) ->
+                   ArgTypes = bif_arg_types(Op, Ss),
+                   SuccVst = foldl(fun({Arg, T}, V) ->
+                                           update_type(fun meet/2, T, Arg, V)
+                                   end, SuccVst0, zip(Ss, ArgTypes)),
 
-    ArgTypes = bif_arg_types(Op, Ss),
-    Vst3 = foldl(fun({Arg, T}, Vsti) ->
-                         update_type(fun meet/2, T, Arg, Vsti)
-                 end, Vst2, zip(Ss, ArgTypes)),
+                   Type = bif_return_type(Op, Ss, SuccVst),
 
-    Type = bif_return_type(Op, Ss, Vst3),
-    Vst = prune_x_regs(Live, Vst3),
-    extract_term(Type, {gc_bif,Op}, Ss, Dst, Vst, Vst0);
+                   %% We're passing Vst0 as the original because the
+                   %% registers were pruned before the branch.
+                   extract_term(Type, {gc_bif,Op}, Ss, Dst, SuccVst, Vst0)
+           end);
 valfun_4(return, #vst{current=#st{numy=none}}=Vst) ->
     assert_durable_term({x,0}, Vst),
     kill_state(Vst);
 valfun_4(return, #vst{current=#st{numy=NumY}}) ->
     error({stack_frame,NumY});
-valfun_4({loop_rec,{f,Fail},Dst}, Vst0) ->
-    %% This term may not be part of the root set until
-    %% remove_message/0 is executed. If control transfers
-    %% to the loop_rec_end/1 instruction, no part of
-    %% this term must be stored in a Y register.
-    Vst1 = branch_state(Fail, Vst0),
-    {Ref, Vst} = new_value(term, loop_rec, [], Vst1),
-    mark_fragile(Dst, set_reg_vref(Ref, Dst, Vst));
+valfun_4({loop_rec,{f,Fail},Dst}, Vst) ->
+    %% This term may not be part of the root set until remove_message/0 is
+    %% executed. If control transfers to the loop_rec_end/1 instruction, no
+    %% part of this term must be stored in a Y register.
+    branch(Fail, Vst,
+           fun(SuccVst0) ->
+                   {Ref, SuccVst} = new_value(term, loop_rec, [], SuccVst0),
+                   mark_fragile(Dst, set_reg_vref(Ref, Dst, SuccVst))
+           end);
 valfun_4({wait,_}, Vst) ->
     verify_y_init(Vst),
     kill_state(Vst);
@@ -769,14 +802,14 @@ valfun_4({set_tuple_element,Src,Tuple,N}, Vst) ->
     Es = set_element_type({integer,I}, get_term_type(Src, Vst), Es0),
     override_type({tuple, Sz, Es}, Tuple, Vst);
 %% Match instructions.
-valfun_4({select_val,Src,{f,Fail},{list,Choices}}, Vst0) ->
-    assert_term(Src, Vst0),
+valfun_4({select_val,Src,{f,Fail},{list,Choices}}, Vst) ->
+    assert_term(Src, Vst),
     assert_choices(Choices),
-    select_val_branches(Fail, Src, Choices, Vst0);
+    validate_select_val(Fail, Choices, Src, Vst);
 valfun_4({select_tuple_arity,Tuple,{f,Fail},{list,Choices}}, Vst) ->
     assert_type(tuple, Tuple, Vst),
     assert_arities(Choices),
-    select_arity_branches(Fail, Choices, Tuple, Vst);
+    validate_select_tuple_arity(Fail, Choices, Tuple, Vst);
 
 %% New bit syntax matching instructions.
 valfun_4({test,bs_start_match3,{f,Fail},Live,[Src],Dst}, Vst) ->
@@ -785,17 +818,17 @@ valfun_4({test,bs_start_match2,{f,Fail},Live,[Src,Slots],Dst}, Vst) ->
     validate_bs_start_match(Fail, Live, bsm_match_state(Slots), Src, Dst, Vst);
 valfun_4({test,bs_match_string,{f,Fail},[Ctx,_,_]}, Vst) ->
     bsm_validate_context(Ctx, Vst),
-    branch_state(Fail, Vst);
+    branch(Fail, Vst, fun(V) -> V end);
 valfun_4({test,bs_skip_bits2,{f,Fail},[Ctx,Src,_,_]}, Vst) ->
     bsm_validate_context(Ctx, Vst),
     assert_term(Src, Vst),
-    branch_state(Fail, Vst);
+    branch(Fail, Vst, fun(V) -> V end);
 valfun_4({test,bs_test_tail2,{f,Fail},[Ctx,_]}, Vst) ->
     bsm_validate_context(Ctx, Vst),
-    branch_state(Fail, Vst);
+    branch(Fail, Vst, fun(V) -> V end);
 valfun_4({test,bs_test_unit,{f,Fail},[Ctx,_]}, Vst) ->
     bsm_validate_context(Ctx, Vst),
-    branch_state(Fail, Vst);
+    branch(Fail, Vst, fun(V) -> V end);
 valfun_4({test,bs_skip_utf8,{f,Fail},[Ctx,Live,_]}, Vst) ->
     validate_bs_skip_utf(Fail, Ctx, Live, Vst);
 valfun_4({test,bs_skip_utf16,{f,Fail},[Ctx,Live,_]}, Vst) ->
@@ -830,6 +863,10 @@ valfun_4({bs_set_position, Ctx, Pos}, Vst) ->
     Vst;
 
 %% Other test instructions.
+valfun_4({test,has_map_fields,{f,Lbl},Src,{list,List}}, Vst) ->
+    assert_type(map, Src, Vst),
+    assert_unique_map_keys(List),
+    branch(Lbl, Vst, fun(V) -> V end);
 valfun_4({test,is_atom,{f,Lbl},[Src]}, Vst) ->
     type_test(Lbl, {atom,[]}, Src, Vst);
 valfun_4({test,is_binary,{f,Lbl},[Src]}, Vst) ->
@@ -850,70 +887,68 @@ valfun_4({test,is_number,{f,Lbl},[Src]}, Vst) ->
     type_test(Lbl, number, Src, Vst);
 valfun_4({test,is_list,{f,Lbl},[Src]}, Vst) ->
     type_test(Lbl, list, Src, Vst);
+valfun_4({test,is_map,{f,Lbl},[Src]}, Vst) ->
+    type_test(Lbl, map, Src, Vst);
 valfun_4({test,is_nil,{f,Lbl},[Src]}, Vst) ->
     %% is_nil is an exact check against the 'nil' value, and should not be
     %% treated as a simple type test.
     assert_term(Src, Vst),
-    complex_test(Lbl,
-                 fun(FailVst) ->
-                         update_ne_types(Src, nil, FailVst)
-                 end,
-                 fun(SuccVst) ->
-                         update_eq_types(Src, nil, SuccVst)
-                 end, Vst);
-valfun_4({test,is_map,{f,Lbl},[Src]}, Vst) ->
-    case Src of
-        {Tag,_} when Tag =:= x; Tag =:= y ->
-            type_test(Lbl, map, Src, Vst);
-        {literal,Map} when is_map(Map) ->
-            Vst;
-        _ ->
-            assert_term(Src, Vst),
-            kill_state(Vst)
-    end;
-valfun_4({test,test_arity,{f,Lbl},[Tuple,Sz]}, Vst0) when is_integer(Sz) ->
-    assert_type(tuple, Tuple, Vst0),
-    Vst = branch_state(Lbl, Vst0),
-    update_type(fun meet/2, {tuple,Sz,#{}}, Tuple, Vst);
-valfun_4({test,is_tagged_tuple,{f,Lbl},[Src,Sz,Atom]}, Vst0) ->
-    assert_term(Src, Vst0),
-    Vst = branch_state(Lbl, Vst0),
-    update_type(fun meet/2, {tuple,Sz,#{ {integer,1} => Atom }}, Src, Vst);
-valfun_4({test,has_map_fields,{f,Lbl},Src,{list,List}}, Vst) ->
-    assert_type(map, Src, Vst),
-    assert_unique_map_keys(List),
-    branch_state(Lbl, Vst);
+    branch(Lbl, Vst,
+           fun(FailVst) ->
+                   update_ne_types(Src, nil, FailVst)
+           end,
+           fun(SuccVst) ->
+                   update_eq_types(Src, nil, SuccVst)
+           end);
+valfun_4({test,test_arity,{f,Lbl},[Tuple,Sz]}, Vst) when is_integer(Sz) ->
+    assert_type(tuple, Tuple, Vst),
+    Type = {tuple, Sz, #{}},
+    type_test(Lbl, Type, Tuple, Vst);
+valfun_4({test,is_tagged_tuple,{f,Lbl},[Src,Sz,Atom]}, Vst) ->
+    assert_term(Src, Vst),
+    Type = {tuple, Sz, #{ {integer,1} => Atom }},
+    type_test(Lbl, Type, Src, Vst);
 valfun_4({test,is_eq_exact,{f,Lbl},[Src,Val]=Ss}, Vst) ->
     validate_src(Ss, Vst),
-    complex_test(Lbl,
-                 fun(FailVst) ->
-                         update_ne_types(Src, Val, FailVst)
-                 end,
-                 fun(SuccVst) ->
-                         update_eq_types(Src, Val, SuccVst)
-                 end, Vst);
+    branch(Lbl, Vst,
+           fun(FailVst) ->
+                   update_ne_types(Src, Val, FailVst)
+           end,
+           fun(SuccVst) ->
+                   update_eq_types(Src, Val, SuccVst)
+           end);
 valfun_4({test,is_ne_exact,{f,Lbl},[Src,Val]=Ss}, Vst) ->
     validate_src(Ss, Vst),
-    complex_test(Lbl,
-                 fun(FailVst) ->
-                         update_eq_types(Src, Val, FailVst)
-                 end,
-                 fun(SuccVst) ->
-                         update_ne_types(Src, Val, SuccVst)
-                 end, Vst);
+    branch(Lbl, Vst,
+           fun(FailVst) ->
+                   update_eq_types(Src, Val, FailVst)
+           end,
+           fun(SuccVst) ->
+                   update_ne_types(Src, Val, SuccVst)
+           end);
 valfun_4({test,_Op,{f,Lbl},Src}, Vst) ->
+    %% is_pid, is_reference, et cetera.
     validate_src(Src, Vst),
-    branch_state(Lbl, Vst);
+    branch(Lbl, Vst, fun(V) -> V end);
 valfun_4({bs_add,{f,Fail},[A,B,_],Dst}, Vst) ->
     assert_term(A, Vst),
     assert_term(B, Vst),
-    create_term({integer,[]}, bs_add, [A, B], Dst, branch_state(Fail, Vst));
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   create_term({integer,[]}, bs_add, [A, B], Dst, SuccVst)
+           end);
 valfun_4({bs_utf8_size,{f,Fail},A,Dst}, Vst) ->
     assert_term(A, Vst),
-    create_term({integer,[]}, bs_utf8_size, [A], Dst, branch_state(Fail, Vst));
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   create_term({integer,[]}, bs_utf8_size, [A], Dst, SuccVst)
+           end);
 valfun_4({bs_utf16_size,{f,Fail},A,Dst}, Vst) ->
     assert_term(A, Vst),
-    create_term({integer,[]}, bs_utf16_size, [A], Dst, branch_state(Fail, Vst));
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   create_term({integer,[]}, bs_utf16_size, [A], Dst, SuccVst)
+           end);
 valfun_4({bs_init2,{f,Fail},Sz,Heap,Live,_,Dst}, Vst0) ->
     verify_live(Live, Vst0),
     verify_y_init(Vst0),
@@ -923,10 +958,12 @@ valfun_4({bs_init2,{f,Fail},Sz,Heap,Live,_,Dst}, Vst0) ->
 	true ->
 	    assert_term(Sz, Vst0)
     end,
-    Vst1 = heap_alloc(Heap, Vst0),
-    Vst2 = branch_state(Fail, Vst1),
-    Vst = prune_x_regs(Live, Vst2),
-    create_term(binary, bs_init2, [], Dst, Vst, Vst0);
+    Vst = heap_alloc(Heap, Vst0),
+    branch(Fail, Vst,
+           fun(SuccVst0) ->
+                   SuccVst = prune_x_regs(Live, SuccVst0),
+                   create_term(binary, bs_init2, [], Dst, SuccVst, SuccVst0)
+           end);
 valfun_4({bs_init_bits,{f,Fail},Sz,Heap,Live,_,Dst}, Vst0) ->
     verify_live(Live, Vst0),
     verify_y_init(Vst0),
@@ -936,47 +973,71 @@ valfun_4({bs_init_bits,{f,Fail},Sz,Heap,Live,_,Dst}, Vst0) ->
 	true ->
 	    assert_term(Sz, Vst0)
     end,
-    Vst1 = heap_alloc(Heap, Vst0),
-    Vst2 = branch_state(Fail, Vst1),
-    Vst = prune_x_regs(Live, Vst2),
-    create_term(binary, bs_init_bits, [], Dst, Vst);
+    Vst = heap_alloc(Heap, Vst0),
+    branch(Fail, Vst,
+           fun(SuccVst0) ->
+                   SuccVst = prune_x_regs(Live, SuccVst0),
+                   create_term(binary, bs_init_bits, [], Dst, SuccVst)
+           end);
 valfun_4({bs_append,{f,Fail},Bits,Heap,Live,_Unit,Bin,_Flags,Dst}, Vst0) ->
     verify_live(Live, Vst0),
     verify_y_init(Vst0),
     assert_term(Bits, Vst0),
     assert_term(Bin, Vst0),
-    Vst1 = heap_alloc(Heap, Vst0),
-    Vst2 = branch_state(Fail, Vst1),
-    Vst = prune_x_regs(Live, Vst2),
-    create_term(binary, bs_append, [Bin], Dst, Vst, Vst0);
-valfun_4({bs_private_append,{f,Fail},Bits,_Unit,Bin,_Flags,Dst}, Vst0) ->
-    assert_term(Bits, Vst0),
-    assert_term(Bin, Vst0),
-    Vst = branch_state(Fail, Vst0),
-    create_term(binary, bs_private_append, [Bin], Dst, Vst);
+    Vst = heap_alloc(Heap, Vst0),
+    branch(Fail, Vst,
+           fun(SuccVst0) ->
+                   SuccVst = prune_x_regs(Live, SuccVst0),
+                   create_term(binary, bs_append, [Bin], Dst, SuccVst, SuccVst0)
+           end);
+valfun_4({bs_private_append,{f,Fail},Bits,_Unit,Bin,_Flags,Dst}, Vst) ->
+    assert_term(Bits, Vst),
+    assert_term(Bin, Vst),
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   create_term(binary, bs_private_append, [Bin], Dst, SuccVst)
+           end);
 valfun_4({bs_put_string,Sz,_}, Vst) when is_integer(Sz) ->
     Vst;
 valfun_4({bs_put_binary,{f,Fail},Sz,_,_,Src}, Vst) ->
     assert_term(Sz, Vst),
     assert_term(Src, Vst),
-    branch_state(Fail, Vst);
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   update_type(fun meet/2, binary, Src, SuccVst)
+           end);
 valfun_4({bs_put_float,{f,Fail},Sz,_,_,Src}, Vst) ->
     assert_term(Sz, Vst),
     assert_term(Src, Vst),
-    branch_state(Fail, Vst);
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   update_type(fun meet/2, {float,[]}, Src, SuccVst)
+           end);
 valfun_4({bs_put_integer,{f,Fail},Sz,_,_,Src}, Vst) ->
     assert_term(Sz, Vst),
     assert_term(Src, Vst),
-    branch_state(Fail, Vst);
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   update_type(fun meet/2, {integer,[]}, Src, SuccVst)
+           end);
 valfun_4({bs_put_utf8,{f,Fail},_,Src}, Vst) ->
     assert_term(Src, Vst),
-    branch_state(Fail, Vst);
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   update_type(fun meet/2, {integer,[]}, Src, SuccVst)
+           end);
 valfun_4({bs_put_utf16,{f,Fail},_,Src}, Vst) ->
     assert_term(Src, Vst),
-    branch_state(Fail, Vst);
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   update_type(fun meet/2, {integer,[]}, Src, SuccVst)
+           end);
 valfun_4({bs_put_utf32,{f,Fail},_,Src}, Vst) ->
     assert_term(Src, Vst),
-    branch_state(Fail, Vst);
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   update_type(fun meet/2, {integer,[]}, Src, SuccVst)
+           end);
 %% Map instructions.
 valfun_4({put_map_assoc=Op,{f,Fail},Src,Dst,Live,{list,List}}, Vst) ->
     verify_put_map(Op, Fail, Src, Dst, Live, List, Vst);
@@ -991,15 +1052,15 @@ verify_get_map(Fail, Src, List, Vst0) ->
     assert_not_literal(Src),                    %OTP 22.
     assert_type(map, Src, Vst0),
 
-    complex_test(Fail,
-                 fun(FailVst) ->
-                         clobber_map_vals(List, Src, FailVst)
-                 end,
-                 fun(SuccVst) ->
-                         Keys = extract_map_keys(List),
-                         assert_unique_map_keys(Keys),
-                         extract_map_vals(List, Src, SuccVst, SuccVst)
-                 end, Vst0).
+    branch(Fail, Vst0,
+           fun(FailVst) ->
+                   clobber_map_vals(List, Src, FailVst)
+           end,
+           fun(SuccVst) ->
+                   Keys = extract_map_keys(List),
+                   assert_unique_map_keys(Keys),
+                   extract_map_vals(List, Src, SuccVst, SuccVst)
+           end).
 
 %% get_map_elements may leave its destinations in an inconsistent state when
 %% the fail label is taken. Consider the following:
@@ -1033,13 +1094,16 @@ verify_put_map(Op, Fail, Src, Dst, Live, List, Vst0) ->
     assert_type(map, Src, Vst0),
     verify_live(Live, Vst0),
     verify_y_init(Vst0),
-    [assert_term(Term, Vst0) || Term <- List],
-    Vst1 = heap_alloc(0, Vst0),
-    Vst2 = branch_state(Fail, Vst1),
-    Vst = prune_x_regs(Live, Vst2),
-    Keys = extract_map_keys(List),
-    assert_unique_map_keys(Keys),
-    create_term(map, Op, [Src], Dst, Vst, Vst0).
+    _ = [assert_term(Term, Vst0) || Term <- List],
+    Vst = heap_alloc(0, Vst0),
+
+    branch(Fail, Vst,
+           fun(SuccVst0) ->
+                   SuccVst = prune_x_regs(Live, SuccVst0),
+                   Keys = extract_map_keys(List),
+                   assert_unique_map_keys(Keys),
+                   create_term(map, Op, [Src], Dst, SuccVst, SuccVst0)
+           end).
 
 %%
 %% Common code for validating bs_start_match* instructions.
@@ -1052,40 +1116,60 @@ validate_bs_start_match(Fail, Live, Type, Src, Dst, Vst) ->
     %% #ms{} can represent either a match context or a term, so we have to mark
     %% the source as a term if it fails with a match context as an input. This
     %% hack is only needed until we get proper union types.
-    complex_test(Fail,
-                 fun(FailVst) ->
-                         case get_raw_type(Src, FailVst) of
-                             #ms{} -> override_type(term, Src, FailVst);
-                             _ -> FailVst
-                         end
-                 end,
-                 fun(SuccVst0) ->
-                         SuccVst1 = update_type(fun meet/2, binary, Src, SuccVst0),
-                         SuccVst = prune_x_regs(Live, SuccVst1),
-                         extract_term(Type, bs_start_match, [Src], Dst,
-                                      SuccVst, SuccVst0)
-                 end, Vst).
+    branch(Fail, Vst,
+           fun(FailVst) ->
+                   case get_movable_term_type(Src, FailVst) of
+                       #ms{} -> override_type(term, Src, FailVst);
+                       _ -> FailVst
+                   end
+           end,
+           fun(SuccVst0) ->
+                   SuccVst1 = update_type(fun meet/2, binary,
+                                          Src, SuccVst0),
+                   SuccVst = prune_x_regs(Live, SuccVst1),
+                   extract_term(Type, bs_start_match, [Src], Dst,
+                                SuccVst, SuccVst0)
+           end).
 
 %%
 %% Common code for validating bs_get* instructions.
 %%
-validate_bs_get(Op, Fail, Ctx, Live, Type, Dst, Vst0) ->
-    bsm_validate_context(Ctx, Vst0),
-    verify_live(Live, Vst0),
-    verify_y_init(Vst0),
-    Vst1 = prune_x_regs(Live, Vst0),
-    Vst = branch_state(Fail, Vst1),
-    extract_term(Type, Op, [Ctx], Dst, Vst, Vst0).
+validate_bs_get(Op, Fail, Ctx, Live, Type, Dst, Vst) ->
+    bsm_validate_context(Ctx, Vst),
+    verify_live(Live, Vst),
+    verify_y_init(Vst),
+
+    branch(Fail, Vst,
+           fun(SuccVst0) ->
+                   SuccVst = prune_x_regs(Live, SuccVst0),
+                   extract_term(Type, Op, [Ctx], Dst, SuccVst, SuccVst0)
+           end).
 
 %%
 %% Common code for validating bs_skip_utf* instructions.
 %%
-validate_bs_skip_utf(Fail, Ctx, Live, Vst0) ->
-    bsm_validate_context(Ctx, Vst0),
-    verify_y_init(Vst0),
-    verify_live(Live, Vst0),
-    Vst = prune_x_regs(Live, Vst0),
-    branch_state(Fail, Vst).
+validate_bs_skip_utf(Fail, Ctx, Live, Vst) ->
+    bsm_validate_context(Ctx, Vst),
+    verify_y_init(Vst),
+    verify_live(Live, Vst),
+
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   prune_x_regs(Live, SuccVst)
+           end).
+
+%%
+%% Common code for is_$type instructions.
+%%
+type_test(Fail, Type, Reg, Vst) ->
+    assert_term(Reg, Vst),
+    branch(Fail, Vst,
+           fun(FailVst) ->
+                   update_type(fun subtract/2, Type, Reg, FailVst)
+           end,
+           fun(SuccVst) ->
+                   update_type(fun meet/2, Type, Reg, SuccVst)
+           end).
 
 %%
 %% Special state handling for setelement/3 and set_tuple_element/3 instructions.
@@ -1156,9 +1240,8 @@ verify_local_args(-1, _Lbl, _CtxIds, _Vst) ->
     ok;
 verify_local_args(X, Lbl, CtxIds, Vst) ->
     Reg = {x, X},
-    assert_movable(Reg, Vst),
     assert_not_fragile(Reg, Vst),
-    case get_raw_type(Reg, Vst) of
+    case get_movable_term_type(Reg, Vst) of
         #ms{id=Id}=Type ->
             case CtxIds of
                 #{ Id := Other } ->
@@ -1347,7 +1430,7 @@ assert_arities(_) -> error(bad_tuple_arity_list).
 %%%
 
 float_op(Ss, Dst, Vst0) ->
-    [assert_freg_set(S, Vst0) || S <- Ss],
+    _ = [assert_freg_set(S, Vst0) || S <- Ss],
     assert_fls(cleared, Vst0),
     Vst = set_fls(cleared, Vst0),
     set_freg(Dst, Vst).
@@ -1424,7 +1507,7 @@ bsm_validate_context(Reg, Vst) ->
     ok.
 
 bsm_get_context({Kind,_}=Reg, Vst) when Kind =:= x; Kind =:= y->
-    case get_raw_type(Reg, Vst) of
+    case get_movable_term_type(Reg, Vst) of
         #ms{}=Ctx -> Ctx;
         _ -> error({no_bsm_context,Reg})
     end;
@@ -1459,44 +1542,46 @@ bsm_restore(Reg, SavePoint, Vst) ->
 	_ -> error({illegal_restore,SavePoint,range})
     end.
 
-select_val_branches(Fail, Src, Choices, Vst0) ->
-    Vst = svb_1(Choices, Src, Vst0),
-    kill_state(branch_state(Fail, Vst)).
-
-svb_1([Val,{f,L}|T], Src, Vst0) ->
-    Vst = complex_test(L,
-                       fun(BranchVst) ->
-                               update_eq_types(Src, Val, BranchVst)
-                       end,
-                       fun(FailVst) ->
-                               update_ne_types(Src, Val, FailVst)
-                       end, Vst0),
-    svb_1(T, Src, Vst);
-svb_1([], _, Vst) ->
-    Vst.
-
-select_arity_branches(Fail, List, Tuple, Vst0) ->
-    Type = get_term_type(Tuple, Vst0),
-    Vst = sab_1(List, Tuple, Type, Vst0),
-    kill_state(branch_state(Fail, Vst)).
-
-sab_1([Sz,{f,L}|T], Tuple, {tuple,[_],Es}=Type0, Vst0) ->
-    #vst{current=St0} = Vst0,
-    Vst1 = update_type(fun meet/2, {tuple,Sz,Es}, Tuple, Vst0),
-    Vst2 = branch_state(L, Vst1),
-    Vst = Vst2#vst{current=St0},
-
-    sab_1(T, Tuple, Type0, Vst);
-sab_1([Sz,{f,L}|T], Tuple, {tuple,Sz,_Es}=Type, Vst0) ->
-    %% The type is already correct. (This test is redundant.)
-    Vst = branch_state(L, Vst0),
-    sab_1(T, Tuple, Type, Vst);
-sab_1([_,{f,_}|T], Tuple, Type, Vst) ->
-    %% We already have an established different exact size for the tuple.
-    %% This label can't possibly be reached.
-    sab_1(T, Tuple, Type, Vst);
-sab_1([], _, _, #vst{}=Vst) ->
-    Vst.
+validate_select_val(_Fail, _Choices, _Src, #vst{current=none}=Vst) ->
+    %% We've already branched on all of Src's possible values, so we know we
+    %% can't reach the fail label or any of the remaining choices.
+    Vst;
+validate_select_val(Fail, [Val,{f,L}|T], Src, Vst0) ->
+    Vst = branch(L, Vst0,
+                 fun(BranchVst) ->
+                         update_eq_types(Src, Val, BranchVst)
+                 end,
+                 fun(FailVst) ->
+                         update_ne_types(Src, Val, FailVst)
+                 end),
+    validate_select_val(Fail, T, Src, Vst);
+validate_select_val(Fail, [], _, Vst) ->
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   %% The next instruction is never executed.
+                   kill_state(SuccVst)
+           end).
+
+validate_select_tuple_arity(_Fail, _Choices, _Src, #vst{current=none}=Vst) ->
+    %% We've already branched on all of Src's possible values, so we know we
+    %% can't reach the fail label or any of the remaining choices.
+    Vst;
+validate_select_tuple_arity(Fail, [Arity,{f,L}|T], Tuple, Vst0) ->
+    Type = {tuple, Arity, #{}},
+    Vst = branch(L, Vst0,
+                 fun(BranchVst) ->
+                         update_type(fun meet/2, Type, Tuple, BranchVst)
+                 end,
+                 fun(FailVst) ->
+                         update_type(fun subtract/2, Type, Tuple, FailVst)
+                 end),
+    validate_select_tuple_arity(Fail, T, Tuple, Vst);
+validate_select_tuple_arity(Fail, [], _, #vst{}=Vst) ->
+    branch(Fail, Vst,
+           fun(SuccVst) ->
+                   %% The next instruction is never executed.
+                   kill_state(SuccVst)
+           end).
 
 infer_types({Kind,_}=Reg, Vst) when Kind =:= x; Kind =:= y ->
     infer_types(get_reg_vref(Reg, Vst), Vst);
@@ -1628,26 +1713,6 @@ resolve_args([Lit | Args], Vst) ->
 resolve_args([], _Vst) ->
     [].
 
-%% Helper functions for tests that alter state on both the success and fail
-%% branches, keeping the states from tainting each other.
-complex_test(Fail, FailFun, SuccFun, Vst0) ->
-    #vst{current=St0} = Vst0,
-    Vst1 = FailFun(Vst0),
-    Vst2 = branch_state(Fail, Vst1),
-    Vst = Vst2#vst{current=St0},
-    SuccFun(Vst).
-
-%% Helper function for simple "is_type" tests.
-type_test(Fail, Type, Reg, Vst) ->
-    assert_term(Reg, Vst),
-    complex_test(Fail,
-                 fun(FailVst) ->
-                         update_type(fun subtract/2, Type, Reg, FailVst)
-                 end,
-                 fun(SuccVst) ->
-                         update_type(fun meet/2, Type, Reg, SuccVst)
-                 end, Vst).
-
 %% Overrides the type of Reg. This is ugly but a necessity for certain
 %% destructive operations.
 override_type(Type, Reg, Vst) ->
@@ -1655,7 +1720,7 @@ override_type(Type, Reg, Vst) ->
 
 %% This is used when linear code finds out more and more information about a
 %% type, so that the type gets more specialized.
-update_type(Merge, Type0, #value_ref{}=Ref, Vst) ->
+update_type(Merge, With, #value_ref{}=Ref, Vst) ->
     %% If the old type can't be merged with the new one, the type information
     %% is inconsistent and we know that some instructions will never be
     %% executed at run-time. For example:
@@ -1664,21 +1729,47 @@ update_type(Merge, Type0, #value_ref{}=Ref, Vst) ->
     %%   {test,is_tuple,Fail,[Reg]}.
     %%   {test,test_arity,Fail,[Reg,5]}.
     %%
-    %% Note that the test_arity instruction can never be reached, so we use the
-    %% new type instead of 'none'.
-    Type = case Merge(get_raw_type(Ref, Vst), Type0) of
-               none -> Type0;
-               T -> T
-           end,
-    set_type(Type, Ref, Vst);
-update_type(Merge, Type, {Kind,_}=Reg, Vst) when Kind =:= x; Kind =:= y ->
-    update_type(Merge, Type, get_reg_vref(Reg, Vst), Vst);
-update_type(_Merge, _Type, Literal, Vst) ->
+    %% Note that the test_arity instruction can never be reached, so we need to
+    %% kill the state to avoid raising an error when we encounter it.
+    %%
+    %% Simply returning `kill_state(Vst)` is unsafe however as we might be in
+    %% the middle of an instruction, and altering the rest of the validator
+    %% (eg. prune_x_regs/2) to no-op on dead states is prone to error.
+    %%
+    %% We therefore throw a 'type_conflict' error instead, which causes
+    %% validation to fail unless we're in a context where such errors can be
+    %% handled, such as in a branch handler.
+    Current = get_raw_type(Ref, Vst),
+    case Merge(Current, With) of
+        none -> throw({type_conflict, Current, With});
+        Type -> set_type(Type, Ref, Vst)
+    end;
+update_type(Merge, With, {Kind,_}=Reg, Vst) when Kind =:= x; Kind =:= y ->
+    update_type(Merge, With, get_reg_vref(Reg, Vst), Vst);
+update_type(Merge, With, Literal, Vst) ->
     assert_literal(Literal),
-    Vst.
+    %% Literals always retain their type, but we still need to bail on type
+    %% conflicts.
+    case Merge(Literal, With) of
+        none -> throw({type_conflict, Literal, With});
+        _Type -> Vst
+    end.
 
 update_ne_types(LHS, RHS, Vst) ->
-    update_type(fun subtract/2, get_term_type(RHS, Vst), LHS, Vst).
+    %% While updating types on equality is fairly straightforward, inequality
+    %% is a bit trickier since all we know is that the *value* of LHS differs
+    %% from RHS, so we can't blindly subtract their types.
+    %%
+    %% Consider `number =/= {integer,[]}`; all we know is that LHS isn't equal
+    %% to some *specific integer* of unknown value, and if we were to subtract
+    %% {integer,[]} we would erroneously infer that the new type is {float,[]}.
+    %%
+    %% Therefore, we only subtract when we know that RHS has a specific value.
+    RType = get_term_type(RHS, Vst),
+    case is_literal(RType) of
+        true -> update_type(fun subtract/2, RType, LHS, Vst);
+        false -> Vst
+    end.
 
 update_eq_types(LHS, RHS, Vst0) ->
     Infer = infer_types(LHS, Vst0),
@@ -1786,19 +1877,27 @@ assert_term(Src, Vst) ->
     ok.
 
 assert_movable(Src, Vst) ->
-    _ = get_move_term_type(Src, Vst),
+    _ = get_movable_term_type(Src, Vst),
     ok.
 
-assert_literal(nil) -> ok;
-assert_literal({atom,A}) when is_atom(A) -> ok;
-assert_literal({float,F}) when is_float(F) -> ok;
-assert_literal({integer,I}) when is_integer(I) -> ok;
-assert_literal({literal,_L}) -> ok;
-assert_literal(T) -> error({literal_required,T}).
+assert_literal(Src) ->
+    case is_literal(Src) of
+        true -> ok;
+        false -> error({literal_required,Src})
+    end.
+
+assert_not_literal(Src) ->
+    case is_literal(Src) of
+        true -> error({literal_not_allowed,Src});
+        false -> ok
+    end.
 
-assert_not_literal({x,_}) -> ok;
-assert_not_literal({y,_}) -> ok;
-assert_not_literal(Literal) -> error({literal_not_allowed,Literal}).
+is_literal(nil) -> true;
+is_literal({atom,A}) when is_atom(A) -> true;
+is_literal({float,F}) when is_float(F) -> true;
+is_literal({integer,I}) when is_integer(I) -> true;
+is_literal({literal,_L}) -> true;
+is_literal(_) -> false.
 
 %% The possible types.
 %%
@@ -2050,6 +2149,7 @@ assert_tuple_elements(Limit, Es) ->
 %%  Subtract Type2 from Type2. Example:
 %%      subtract(list, nil) -> cons
 
+subtract(Same, Same) -> none;
 subtract(list, nil) -> cons;
 subtract(list, cons) -> nil;
 subtract(number, {integer,[]}) -> {float,[]};
@@ -2082,11 +2182,10 @@ assert_type(Needed, Actual) ->
 get_element_type(Key, Src, Vst) ->
     get_element_type_1(Key, get_term_type(Src, Vst)).
 
-get_element_type_1({integer,Index}=Key, {tuple,Sz,Es}) ->
+get_element_type_1({integer,_}=Key, {tuple,_Sz,Es}) ->
     case Es of
         #{ Key := Type } -> Type;
-        #{} when Index =< Sz -> term;
-        #{} -> none
+        #{} -> term
     end;
 get_element_type_1(_Index, _Type) ->
     term.
@@ -2103,7 +2202,7 @@ get_tuple_size({integer,Sz}) -> Sz;
 get_tuple_size(_) -> 0.
 
 validate_src(Ss, Vst) when is_list(Ss) ->
-    [assert_term(S, Vst) || S <- Ss],
+    _ = [assert_term(S, Vst) || S <- Ss],
     ok.
 
 %% get_term_type(Src, ValidatorState) -> Type
@@ -2111,22 +2210,23 @@ validate_src(Ss, Vst) when is_list(Ss) ->
 %%  a standard Erlang type (no catch/try tags or match contexts).
 
 get_term_type(Src, Vst) ->
-    case get_move_term_type(Src, Vst) of
+    case get_movable_term_type(Src, Vst) of
         #ms{} -> error({match_context,Src});
         Type -> Type
     end.
 
-%% get_move_term_type(Src, ValidatorState) -> Type
+%% get_movable_term_type(Src, ValidatorState) -> Type
 %%  Get the type of the source Src. The returned type Type will be
 %%  a standard Erlang type (no catch/try tags). Match contexts are OK.
 
-get_move_term_type(Src, Vst) ->
+get_movable_term_type(Src, Vst) ->
     case get_raw_type(Src, Vst) of
         initialized -> error({unassigned,Src});
         uninitialized -> error({uninitialized_reg,Src});
         {catchtag,_} -> error({catchtag,Src});
         {trytag,_} -> error({trytag,Src});
         tuple_in_progress -> error({tuple_in_progress,Src});
+        {literal,_}=Lit -> get_literal_type(Lit);
         Type -> Type
     end.
 
@@ -2145,7 +2245,8 @@ get_tag_type(Src, _) ->
     error({invalid_tag_register,Src}).
 
 %% get_raw_type(Src, ValidatorState) -> Type
-%%  Return the type of a register without doing any validity checks.
+%%  Return the type of a register without doing any validity checks or
+%%  conversions.
 get_raw_type({x,X}=Src, #vst{current=#st{xs=Xs}}=Vst) when is_integer(X) ->
     check_limit(Src),
     case Xs of
@@ -2192,10 +2293,53 @@ glt_1(T) when is_tuple(T) ->
 glt_1(L) ->
     {literal, L}.
 
+%%%
+%%% Branch tracking
+%%%
+
+%% Forks the execution flow, with the provided funs returning the new state of
+%% their respective branch; the "fail" fun returns the state where the branch
+%% is taken, and the "success" fun returns the state where it's not.
+%%
+%% If either path is known not to be taken at runtime (eg. due to a type
+%% conflict), it will simply be discarded.
+-spec branch(Lbl :: label(),
+             Original :: #vst{},
+             FailFun :: BranchFun,
+             SuccFun :: BranchFun) -> #vst{} when
+     BranchFun :: fun((#vst{}) -> #vst{}).
+branch(Lbl, Vst0, FailFun, SuccFun) ->
+    #vst{current=St0} = Vst0,
+    try FailFun(Vst0) of
+        Vst1 ->
+            Vst2 = branch_state(Lbl, Vst1),
+            Vst = Vst2#vst{current=St0},
+            try SuccFun(Vst) of
+                V -> V
+            catch
+                {type_conflict, _, _} ->
+                    %% The instruction is guaranteed to fail; kill the state.
+                    kill_state(Vst)
+            end
+    catch
+        {type_conflict, _, _} ->
+            %% This instruction is guaranteed not to fail, so we run the
+            %% success branch *without* catching type conflicts to avoid hiding
+            %% errors in the validator itself; one of the branches must
+            %% succeed.
+            SuccFun(Vst0)
+    end.
+
+%% A shorthand version of branch/4 for when the state is only altered on
+%% success.
+branch(Fail, Vst, SuccFun) ->
+    branch(Fail, Vst, fun(V) -> V end, SuccFun).
+
+%% Directly branches off the state. This is an "internal" operation that should
+%% be used sparingly.
 branch_state(0, #vst{}=Vst) ->
-    %% If the instruction fails, the stack may be scanned
-    %% looking for a catch tag. Therefore the Y registers
-    %% must be initialized at this point.
+    %% If the instruction fails, the stack may be scanned looking for a catch
+    %% tag. Therefore the Y registers must be initialized at this point.
     verify_y_init(Vst),
     Vst;
 branch_state(L, #vst{current=St,branched=B,ref_ctr=Counter0}=Vst) ->
diff --git a/lib/compiler/test/beam_validator_SUITE.erl b/lib/compiler/test/beam_validator_SUITE.erl
index 265da43f9d..8b39fce479 100644
--- a/lib/compiler/test/beam_validator_SUITE.erl
+++ b/lib/compiler/test/beam_validator_SUITE.erl
@@ -34,7 +34,7 @@
 	 undef_label/1,illegal_instruction/1,failing_gc_guard_bif/1,
 	 map_field_lists/1,cover_bin_opt/1,
 	 val_dsetel/1,bad_tuples/1,bad_try_catch_nesting/1,
-         receive_stacked/1,aliased_types/1]).
+         receive_stacked/1,aliased_types/1,type_conflict/1]).
 
 -include_lib("common_test/include/ct.hrl").
 
@@ -63,7 +63,7 @@ groups() ->
        undef_label,illegal_instruction,failing_gc_guard_bif,
        map_field_lists,cover_bin_opt,val_dsetel,
        bad_tuples,bad_try_catch_nesting,
-       receive_stacked,aliased_types]}].
+       receive_stacked,aliased_types,type_conflict]}].
 
 init_per_suite(Config) ->
     test_lib:recompile(?MODULE),
@@ -156,8 +156,8 @@ call_last(Config) when is_list(Config) ->
 merge_undefined(Config) when is_list(Config) ->
     Errors = do_val(merge_undefined, Config),
     [{{t,handle_call,2},
-      {{call_ext,1,{extfunc,erlang,exit,1}},
-       10,
+      {{call_ext,2,{extfunc,debug,filter,2}},
+       22,
        {uninitialized_reg,{y,_}}}}] = Errors,
     ok.
 
@@ -630,6 +630,27 @@ aliased_types_3(Bug) ->
             hd(List)
     end.
 
+
+%% ERL-867; validation proceeded after a type conflict, causing incorrect types
+%% to be joined.
+
+-record(r, { e1 = e1, e2 = e2 }).
+
+type_conflict(Config) when is_list(Config) ->
+    {e1, e2} = type_conflict_1(#r{}),
+    ok.
+
+type_conflict_1(C) ->
+    Src = id(C#r.e2),
+    TRes = try id(Src) of
+               R -> R
+           catch
+               %% C:R can never match, yet it assumed that the type of 'C' was
+               %% an atom from here on.
+               C:R -> R
+           end,
+    {C#r.e1, TRes}.
+
 %%%-------------------------------------------------------------------------
 
 transform_remove(Remove, Module) ->
diff --git a/lib/compiler/test/beam_validator_SUITE_data/merge_undefined.S b/lib/compiler/test/beam_validator_SUITE_data/merge_undefined.S
index 481d55045d..aa344807e4 100644
--- a/lib/compiler/test/beam_validator_SUITE_data/merge_undefined.S
+++ b/lib/compiler/test/beam_validator_SUITE_data/merge_undefined.S
@@ -15,8 +15,9 @@
     {select_val,{x,0},{f,1},{list,[{atom,gurka},{f,3},{atom,delete},{f,4}]}}.
   {label,3}.
     {allocate_heap,2,6,2}.
-    %% The Y registers are not initialized here.
     {test,is_eq_exact,{f,5},[{x,0},{atom,ok}]}.
+    %% This is unreachable since {x,0} is known not to be 'ok'. We should not
+    %% fail with "uninitialized y registers" on erlang:exit/1
     {move,{atom,nisse},{x,0}}.
     {call_ext,1,{extfunc,erlang,exit,1}}.
   {label,4}.
@@ -29,6 +30,7 @@
     {call_ext,2,{extfunc,io,format,2}}.
     {test,is_ne_exact,{f,6},[{x,0},{atom,ok}]}.
   {label,5}.
+    %% The Y registers are not initialized here.
     {move,{atom,logReader},{x,1}}.
     {move,{atom,console},{x,0}}.
     {call_ext,2,{extfunc,debug,filter,2}}.
diff --git a/lib/compiler/test/beam_validator_SUITE_data/receive_stacked.S b/lib/compiler/test/beam_validator_SUITE_data/receive_stacked.S
index 5b974119c6..a878204d16 100644
--- a/lib/compiler/test/beam_validator_SUITE_data/receive_stacked.S
+++ b/lib/compiler/test/beam_validator_SUITE_data/receive_stacked.S
@@ -240,7 +240,7 @@
           {y,0}}.
     {'%',{no_bin_opt,{binary_used_in,{test,is_binary,{f,34},[{y,0}]}},
                      [63,{file,"receive_stacked.erl"}]}}.
-    {test,is_binary,{f,34},[{y,0}]}.
+    {test,is_eq_exact,{f,34},[{y,0},{literal,<<0,1,2,3>>}]}.
     remove_message.
     {move,{integer,42},{x,0}}.
     {line,[{location,"receive_stacked.erl",64}]}.
@@ -283,7 +283,7 @@
           {y,0}}.
     {'%',{no_bin_opt,{[{x,1},{y,0}],{loop_rec_end,{f,38}},not_handled},
                      [70,{file,"receive_stacked.erl"}]}}.
-    {test,is_binary,{f,39},[{x,0}]}.
+    {test,is_eq_exact,{f,39},[{x,0},{literal,<<0,1,2,3>>}]}.
     remove_message.
     {move,{integer,42},{x,0}}.
     {line,[{location,"receive_stacked.erl",71}]}.