Our functions that call Core.Inference._return_type are failing to account for the possibility that functions can return a Type and that inference is capable of determining that. Simple repro can be seen by testing broadcast (result should be either Array{DataType, 1} or Array{Union{}, 1}):

julia> typeof(broadcast(typeof, Float32[]))
Array{Type{Float32}, 1}

note: map gets the "right" answer, but this is more due to inference failing on @code_typed first(Base.Generator(typeof, Float32[])) rather than it actually handling this case correctly.