Move simple_meet change to simple_meet2

Make sure subtype-path is not affected. Fix ambiguity error found in Pkg-eval.

src/subtype.c

@@ -518,7 +518,7 @@ static jl_value_t *simple_meet(jl_value_t *a, jl_value_t *b)
         return a;
     if (jl_is_typevar(b) && obviously_egal(a, ((jl_tvar_t*)b)->ub))
         return b;
-    if (obviously_disjoint(a, b, 0) || (jl_is_typevar(a) && jl_is_typevar(b)))
+    if (obviously_disjoint(a, b, 0))
         return jl_bottom_type;
     if (!jl_has_free_typevars(a) && !jl_has_free_typevars(b)) {
         if (jl_subtype(a, b)) return a;
@@ -3370,6 +3370,13 @@ static jl_value_t *intersect(jl_value_t *x, jl_value_t *y, jl_stenv_t *e, int pa
     return jl_bottom_type;
 }
 
+static jl_value_t *simple_meet2(jl_value_t *a, jl_value_t *b) {
+    // make sure A=B A=C would be merged into A<:Union{B, C}.
+    if (jl_is_typevar(a) && jl_is_typevar(b) && a != b)
+        return jl_bottom_type;
+    return simple_meet(a, b);
+}
+
 static int merge_env(jl_stenv_t *e, jl_value_t **root, jl_savedenv_t *se, int count)
 {
     if (count == 0) {
@@ -3388,7 +3395,7 @@ static int merge_env(jl_stenv_t *e, jl_value_t **root, jl_savedenv_t *se, int co
             // only merge lb/ub/innervars if this var occurs.
             b1 = jl_svecref(*root, n);
             b2 = v->lb;
-            jl_svecset(*root, n, b1 ? simple_meet(b1, b2) : b2);
+            jl_svecset(*root, n, b1 ? simple_meet2(b1, b2) : b2);
             b1 = jl_svecref(*root, n+1);
             b2 = v->ub;
             jl_svecset(*root, n+1, b1 ? simple_join(b1, b2) : b2);

test/subtype.jl

@@ -2340,6 +2340,11 @@ let S = Tuple{Type{T1}, T1, Val{T1}} where T1<:(Val{S1} where S1<:Val),
     @test_broken I2 <: T
 end
 
+f48167(::Type{Val{L2}}, ::Type{Union{Val{L1}, Set{R}}}) where {L1, R, L2<:L1} = 1
+f48167(::Type{Val{L1}}, ::Type{Union{Val{L2}, Set{R}}}) where {L1, R, L2<:L1} = 2
+f48167(::Type{Val{L}}, ::Type{Union{Val{L}, Set{R}}}) where {L, R} = 3
+@test f48167(Val{Nothing}, Union{Val{Nothing}, Set{Int}}) == 3
+
 @testset "known subtype/intersect issue" begin
     #issue 45874
     # Causes a hang due to jl_critical_error calling back into malloc...