Hmm, AFAIK "reach the dup instructions with different types" is not allowed. See Merging Stack States in ECMA 335.

Even if this is allowed I think it's still possible to deal with. If a basic block containing dup is reached with 2 different stack states then this can be treated as if there actually were 2 distinct basic blocks in the first place.