Adding PoisonValue for representing poison value explicitly in IR

[liuz]

Summary

Define ConstantData::PoisonValue.
Add support for poison value to LLLexer/LLParser/BitcodeReader/BitcodeWriter.
Add support for poison value to llvm-c interface.
Add support for poison value to OCaml binding.
Add m_Poison in PatternMatch.

[nikic]

I would recommend making PoisonValue a subclass of UndefValue. Poison can always be relaxed to undef, and this will prevents lots of regressions when replacing undef with poison values.

[aqjune]

In D71126#2316089, @nikic wrote:

I would recommend making PoisonValue a subclass of UndefValue. Poison can always be relaxed to undef, and this will prevents lots of regressions when replacing undef with poison values.

+1 for this. You'll need to update UndefValue::classof.

[liuz]

PoisonValue is now a subclass of UndefValue

[liuz]

rebased to upstream

[reames]

LGTM.

p.s. I'm very unsure about the merits of having poison being a sub-class of undef, but I'm also completely fine landing this as is and adjusting later. Being able to spell poison directly in tests is a huge win, and I'm more than comfortable evolving in tree as warranted.

[vitalybuka]

http://lab.llvm.org:8011/#/builders/5/builds/1690/steps/9/logs/stdio

74536==WARNING: MemorySanitizer: use-of-uninitialized-value

#0 0x7c7b3ed in llvm::Value::setValueName(llvm::StringMapEntry<llvm::Value*>*) /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/lib/IR/Value.cpp:281:3
#1 0x7c78ec6 in destroyValueName /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/lib/IR/Value.cpp:143:3
#2 0x7c78ec6 in llvm::Value::~Value() /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/lib/IR/Value.cpp:104:3
#3 0x7b389e6 in operator() /b/sanitizer-x86_64-linux-fast/build/libcxx_build_msan/include/c++/v1/memory:2122:5
#4 0x7b389e6 in reset /b/sanitizer-x86_64-linux-fast/build/libcxx_build_msan/include/c++/v1/memory:2383:7
#5 0x7b389e6 in ~unique_ptr /b/sanitizer-x86_64-linux-fast/build/libcxx_build_msan/include/c++/v1/memory:2337:19
#6 0x7b389e6 in destroyAll /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/include/llvm/ADT/DenseMap.h:368:25
#7 0x7b389e6 in llvm::DenseMap<llvm::Type*, std::__1::unique_ptr<llvm::PoisonValue, std::__1::default_delete<llvm::PoisonValue> >, llvm::DenseMapInfo<llvm::Type*>, llvm::detail::DenseMapPair<llvm::Type*, std::__1::unique_ptr<llvm::PoisonValue, std::__1::default_delete<llvm::PoisonValue> > > >::~DenseMap() /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/include/llvm/ADT/DenseMap.h:754:11
#8 0x7b2f91d in llvm::LLVMContextImpl::~LLVMContextImpl() /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/lib/IR/LLVMContextImpl.cpp:125:1
#9 0x7b19cff in llvm::LLVMContext::~LLVMContext() /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/lib/IR/LLVMContext.cpp:94:31
#10 0x2561bb6 in main /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/tools/llc/llc.cpp:366:1
#11 0x7f93b5e3309a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
#12 0x24e0df9 in _start (/b/sanitizer-x86_64-linux-fast/build/llvm_build_msan/bin/llc+0x24e0df9)

[cuviper]

llvm/include/llvm-c/Core.h

272

This is a breaking change to the C ABI -- can we move it to the end of the enum?
https://bugs.llvm.org/show_bug.cgi?id=48905

llvm/bindings/ocaml/llvm/llvm.ml

module ValueKind = struct
   | ConstantPointerNull
   | ConstantStruct
   | ConstantVector
   | Function
   | GlobalAlias
   | GlobalIFunc
   | GlobalVariable
   | UndefValue
+  | PoisonValue
   | Instruction of Opcode.t
 end
 
 module DiagnosticSeverity = struct
   type t =
   | Error
   | Warning
   | Remark

 external indices : llvalue -> int array = "llvm_indices"
 
 (*--... Operations on constants of (mostly) any type .......................--*)
 external is_constant : llvalue -> bool = "llvm_is_constant"
 external const_null : lltype -> llvalue = "LLVMConstNull"
 external const_all_ones : (*int|vec*)lltype -> llvalue = "LLVMConstAllOnes"
 external const_pointer_null : lltype -> llvalue = "LLVMConstPointerNull"
 external undef : lltype -> llvalue = "LLVMGetUndef"
+external poison : lltype -> llvalue = "LLVMGetPoison"
 external is_null : llvalue -> bool = "llvm_is_null"
 external is_undef : llvalue -> bool = "llvm_is_undef"
+external is_poison : llvalue -> bool = "llvm_is_poison"
 external constexpr_opcode : llvalue -> Opcode.t = "llvm_constexpr_get_opcode"
 
 (*--... Operations on instructions .........................................--*)
 external has_metadata : llvalue -> bool = "llvm_has_metadata"
 external metadata : llvalue -> llmdkind -> llvalue option = "llvm_metadata"
 external set_metadata : llvalue -> llmdkind -> llvalue -> unit = "llvm_set_metadata"
 external clear_metadata : llvalue -> llmdkind -> unit = "llvm_clear_metadata"
 

llvm/bindings/ocaml/llvm/llvm.mli

module ValueKind : sig
   | ConstantPointerNull
   | ConstantStruct
   | ConstantVector
   | Function
   | GlobalAlias
   | GlobalIFunc
   | GlobalVariable
   | UndefValue
+  | PoisonValue
   | Instruction of Opcode.t
 end
 
 (** The kind of [Diagnostic], the result of [Diagnostic.severity d].
     See [llvm::DiagnosticSeverity]. *)
 module DiagnosticSeverity : sig
   type t =
   | Error

 (** [const_pointer_null ty] returns the constant null (zero) pointer of the type
     [ty]. See the method [llvm::ConstantPointerNull::get]. *)
 val const_pointer_null : lltype -> llvalue
 
 (** [undef ty] returns the undefined value of the type [ty].
     See the method [llvm::UndefValue::get]. *)
 val undef : lltype -> llvalue
 
+(** [poison ty] returns the poison value of the type [ty].
+    See the method [llvm::PoisonValue::get]. *)
+val poison : lltype -> llvalue
+
 (** [is_null v] returns [true] if the value [v] is the null (zero) value.
     See the method [llvm::Constant::isNullValue]. *)
 val is_null : llvalue -> bool
 
 (** [is_undef v] returns [true] if the value [v] is an undefined value, [false]
     otherwise. Similar to [llvm::isa<UndefValue>]. *)
 val is_undef : llvalue -> bool
 
+(** [is_poison v] returns [true] if the value [v] is a poison value, [false]
+    otherwise. Similar to [llvm::isa<PoisonValue>]. *)
+val is_poison : llvalue -> bool
+
 (** [constexpr_opcode v] returns an [Opcode.t] corresponding to constexpr
     value [v], or [Opcode.Invalid] if [v] is not a constexpr. *)
 val constexpr_opcode : llvalue -> Opcode.t
 
 
 (** {7 Operations on instructions} *)
 
 (** [has_metadata i] returns whether or not the instruction [i] has any

llvm/bindings/ocaml/llvm/llvm_ocaml.c

enum ValueKind {
   ConstantPointerNull,
   ConstantStruct,
   ConstantVector,
   Function,
   GlobalAlias,
   GlobalIFunc,
   GlobalVariable,
   UndefValue,
+  PoisonValue,
   Instruction
 };
 
 /* llvalue -> ValueKind.t */
 #define DEFINE_CASE(Val, Kind) \
     do {if (LLVMIsA##Kind(Val)) CAMLreturn(Val_int(Kind));} while(0)
 
 CAMLprim value llvm_classify_value(LLVMValueRef Val) {
if (LLVMIsAGlobalValue(Val)) {
     DEFINE_CASE(Val, GlobalVariable);
   }
   DEFINE_CASE(Val, Argument);
   DEFINE_CASE(Val, BasicBlock);
   DEFINE_CASE(Val, InlineAsm);
   DEFINE_CASE(Val, MDNode);
   DEFINE_CASE(Val, MDString);
   DEFINE_CASE(Val, UndefValue);
+  DEFINE_CASE(Val, PoisonValue);
   failwith("Unknown Value class");
 }
 
 /* llvalue -> string */
 CAMLprim value llvm_value_name(LLVMValueRef Val) {
   return caml_copy_string(LLVMGetValueName(Val));
 }
 
CAMLprim value llvm_is_null(LLVMValueRef Val) {
   return Val_bool(LLVMIsNull(Val));
 }
 
 /* llvalue -> bool */
 CAMLprim value llvm_is_undef(LLVMValueRef Val) {
   return Val_bool(LLVMIsUndef(Val));
 }
 
+/* llvalue -> bool */
+CAMLprim value llvm_is_poison(LLVMValueRef Val) {
+  return Val_bool(LLVMIsPoison(Val));
+}
+
 /* llvalue -> Opcode.t */
 CAMLprim value llvm_constexpr_get_opcode(LLVMValueRef Val) {
   return LLVMIsAConstantExpr(Val) ?
       Val_int(LLVMGetConstOpcode(Val)) : Val_int(0);
 }
 
 /*--... Operations on instructions .........................................--*/
 

llvm/include/llvm-c/Core.h

typedef enum {
   LLVMGlobalVariableValueKind,
   LLVMBlockAddressValueKind,
   LLVMConstantExprValueKind,
   LLVMConstantArrayValueKind,
   LLVMConstantStructValueKind,
   LLVMConstantVectorValueKind,
 
   LLVMUndefValueValueKind,
+  LLVMPoisonValueValueKind,
   LLVMConstantAggregateZeroValueKind,
   LLVMConstantDataArrayValueKind,
   LLVMConstantDataVectorValueKind,
   LLVMConstantIntValueKind,
   LLVMConstantFPValueKind,
   LLVMConstantPointerNullValueKind,
   LLVMConstantTokenNoneValueKind,
 
macro(Constant)                         \
       macro(ConstantVector)                 \
       macro(GlobalValue)                    \
         macro(GlobalAlias)                  \
         macro(GlobalIFunc)                  \
         macro(GlobalObject)                 \
           macro(Function)                   \
           macro(GlobalVariable)             \
       macro(UndefValue)                     \
+      macro(PoisonValue)                    \
     macro(Instruction)                      \
       macro(UnaryOperator)                  \
       macro(BinaryOperator)                 \
       macro(CallInst)                       \
         macro(IntrinsicInst)                \
           macro(DbgInfoIntrinsic)           \
             macro(DbgVariableIntrinsic)     \
               macro(DbgDeclareInst)         \

 LLVMBool LLVMIsConstant(LLVMValueRef Val);
 
 /**
  * Determine whether a value instance is undefined.
  */
 LLVMBool LLVMIsUndef(LLVMValueRef Val);
 
 /**
+ * Determine whether a value instance is poisonous.
+ */
+LLVMBool LLVMIsPoison(LLVMValueRef Val);
+
+/**
  * Convert value instances between types.
  *
  * Internally, an LLVMValueRef is "pinned" to a specific type. This
  * series of functions allows you to cast an instance to a specific
  * type.
  *
  * If the cast is not valid for the specified type, NULL is returned.
  *

 /**
  * Obtain a constant value referring to an undefined value of a type.
  *
  * @see llvm::UndefValue::get()
  */
 LLVMValueRef LLVMGetUndef(LLVMTypeRef Ty);
 
 /**
+ * Obtain a constant value referring to a poison value of a type.
+ *
+ * @see llvm::PoisonValue::get()
+ */
+LLVMValueRef LLVMGetPoison(LLVMTypeRef Ty);
+
+/**
  * Determine whether a value instance is null.
  *
  * @see llvm::Constant::isNullValue()
  */
 LLVMBool LLVMIsNull(LLVMValueRef Val);
 
 /**
  * Obtain a constant that is a constant pointer pointing to NULL for a

llvm/include/llvm/Bitcode/LLVMBitCodes.h

enum ConstantsCodes {
   CST_CODE_CE_SHUFVEC_EX = 19,   // SHUFVEC_EX:    [opty, opval, opval, opval]
   CST_CODE_CE_INBOUNDS_GEP = 20, // INBOUNDS_GEP:  [n x operands]
   CST_CODE_BLOCKADDRESS = 21,    // CST_CODE_BLOCKADDRESS [fnty, fnval, bb#]
   CST_CODE_DATA = 22,            // DATA:          [n x elements]
   CST_CODE_INLINEASM = 23,       // INLINEASM:     [sideeffect|alignstack|
                                  //                 asmdialect,asmstr,conststr]
   CST_CODE_CE_GEP_WITH_INRANGE_INDEX = 24, //      [opty, flags, n x operands]
   CST_CODE_CE_UNOP = 25,         // CE_UNOP:      [opcode, opval]
+  CST_CODE_POISON = 26,          // POISON
 };
 
 /// CastOpcodes - These are values used in the bitcode files to encode which
 /// cast a CST_CODE_CE_CAST or a XXX refers to.  The values of these enums
 /// have no fixed relation to the LLVM IR enum values.  Changing these will
 /// break compatibility with old files.
 enum CastOpcodes {
   CAST_TRUNC = 0,

llvm/include/llvm/IR/Constants.h

 /// These are used for a variety of purposes, including global variable
 /// initializers and operands to instructions.  'undef' values can occur with
 /// any first-class type.
 ///
 /// Undef values aren't exactly constants; if they have multiple uses, they
 /// can appear to have different bit patterns at each use. See
 /// LangRef.html#undefvalues for details.
 ///
-class UndefValue final : public ConstantData {
+class UndefValue : public ConstantData {
   friend class Constant;
 
   explicit UndefValue(Type *T) : ConstantData(T, UndefValueVal) {}
 
   void destroyConstantImpl();
 
+protected:
+  explicit UndefValue(Type *T, ValueTy vty) : ConstantData(T, vty) {}
+
 public:
   UndefValue(const UndefValue &) = delete;
 
   /// Static factory methods - Return an 'undef' object of the specified type.
   static UndefValue *get(Type *T);
 
   /// If this Undef has array or vector type, return a undef with the right
   /// element type.
public:
   /// Return an undef of the right value for the specified GEP index.
   UndefValue *getElementValue(unsigned Idx) const;
 
   /// Return the number of elements in the array, vector, or struct.
   unsigned getNumElements() const;
 
   /// Methods for support type inquiry through isa, cast, and dyn_cast:
   static bool classof(const Value *V) {
-    return V->getValueID() == UndefValueVal;
+    return V->getValueID() == UndefValueVal ||
+           V->getValueID() == PoisonValueVal;
+  }
+};
+
+//===----------------------------------------------------------------------===//
+/// In order to facilitate speculative execution, many instructions do not
+/// invoke immediate undefined behavior when provided with illegal operands,
+/// and return a poison value instead.
+///
+/// see LangRef.html#poisonvalues for details.
+///
+class PoisonValue final : public UndefValue {
+  friend class Constant;
+
+  explicit PoisonValue(Type *T) : UndefValue(T, PoisonValueVal) {}
+
+  void destroyConstantImpl();
+
+public:
+  PoisonValue(const PoisonValue &) = delete;
+
+  /// Static factory methods - Return an 'poison' object of the specified type.
+  static PoisonValue *get(Type *T);
+
+  /// If this poison has array or vector type, return a poison with the right
+  /// element type.
+  PoisonValue *getSequentialElement() const;
+
+  /// If this poison has struct type, return a poison with the right element
+  /// type for the specified element.
+  PoisonValue *getStructElement(unsigned Elt) const;
+
+  /// Return an poison of the right value for the specified GEP index if we can,
+  /// otherwise return null (e.g. if C is a ConstantExpr).
+  PoisonValue *getElementValue(Constant *C) const;
+
+  /// Return an poison of the right value for the specified GEP index.
+  PoisonValue *getElementValue(unsigned Idx) const;
+
+  /// Methods for support type inquiry through isa, cast, and dyn_cast:
+  static bool classof(const Value *V) {
+    return V->getValueID() == PoisonValueVal;
   }
 };
 
 } // end namespace llvm
 
 #endif // LLVM_IR_CONSTANTS_H

llvm/include/llvm/IR/PatternMatch.h

 /// Match an arbitrary ConstantInt and ignore it.
 inline class_match<ConstantInt> m_ConstantInt() {
   return class_match<ConstantInt>();
 }
 
 /// Match an arbitrary undef constant.
 inline class_match<UndefValue> m_Undef() { return class_match<UndefValue>(); }
 
+/// Match an arbitrary poison constant.
+inline class_match<PoisonValue> m_Poison() { return class_match<PoisonValue>(); }
+
 /// Match an arbitrary Constant and ignore it.
 inline class_match<Constant> m_Constant() { return class_match<Constant>(); }
 
 /// Match an arbitrary basic block value and ignore it.
 inline class_match<BasicBlock> m_BasicBlock() {
   return class_match<BasicBlock>();
 }
 

llvm/include/llvm/IR/Value.def

 
 // ConstantAggregate.
 HANDLE_CONSTANT(ConstantArray)
 HANDLE_CONSTANT(ConstantStruct)
 HANDLE_CONSTANT(ConstantVector)
 
 // ConstantData.
 HANDLE_CONSTANT(UndefValue)
+HANDLE_CONSTANT(PoisonValue)
 HANDLE_CONSTANT(ConstantAggregateZero)
 HANDLE_CONSTANT(ConstantDataArray)
 HANDLE_CONSTANT(ConstantDataVector)
 HANDLE_CONSTANT(ConstantInt)
 HANDLE_CONSTANT(ConstantFP)
 HANDLE_CONSTANT(ConstantPointerNull)
 HANDLE_CONSTANT(ConstantTokenNone)
 

llvm/lib/AsmParser/LLLexer.cpp

#define KEYWORD(STR)                                                           \
   KEYWORD(thread_local);
   KEYWORD(localdynamic);
   KEYWORD(initialexec);
   KEYWORD(localexec);
   KEYWORD(zeroinitializer);
   KEYWORD(undef);
   KEYWORD(null);
   KEYWORD(none);
+  KEYWORD(poison);
   KEYWORD(to);
   KEYWORD(caller);
   KEYWORD(within);
   KEYWORD(from);
   KEYWORD(tail);
   KEYWORD(musttail);
   KEYWORD(notail);
   KEYWORD(target);

llvm/lib/AsmParser/LLParser.h

namespace llvm {
   /// There are several cases where we have to parse the value but where the
   /// type can depend on later context.  This may either be a numeric reference
   /// or a symbolic (%var) reference.  This is just a discriminated union.
   struct ValID {
     enum {
       t_LocalID, t_GlobalID,           // ID in UIntVal.
       t_LocalName, t_GlobalName,       // Name in StrVal.
       t_APSInt, t_APFloat,             // Value in APSIntVal/APFloatVal.
-      t_Null, t_Undef, t_Zero, t_None, // No value.
+      t_Null, t_Undef, t_Zero, t_None, t_Poison, // No value.
       t_EmptyArray,                    // No value:  []
       t_Constant,                      // Value in ConstantVal.
       t_InlineAsm,                     // Value in FTy/StrVal/StrVal2/UIntVal.
       t_ConstantStruct,                // Value in ConstantStructElts.
       t_PackedConstantStruct           // Value in ConstantStructElts.
     } Kind = t_LocalID;
 
     LLLexer::LocTy Loc;

llvm/lib/AsmParser/LLParser.cpp

case lltok::kw_true:
     ID.Kind = ValID::t_Constant;
     break;
   case lltok::kw_false:
     ID.ConstantVal = ConstantInt::getFalse(Context);
     ID.Kind = ValID::t_Constant;
     break;
   case lltok::kw_null: ID.Kind = ValID::t_Null; break;
   case lltok::kw_undef: ID.Kind = ValID::t_Undef; break;
+  case lltok::kw_poison: ID.Kind = ValID::t_Poison; break;
   case lltok::kw_zeroinitializer: ID.Kind = ValID::t_Zero; break;
   case lltok::kw_none: ID.Kind = ValID::t_None; break;
 
   case lltok::lbrace: {
     // ValID ::= '{' ConstVector '}'
     Lex.Lex();
     SmallVector<Constant*, 16> Elts;
     if (parseGlobalValueVector(Elts) ||
if (!Ty->isFirstClassType() || Ty->isLabelTy())
       return error(ID.Loc, "invalid type for null constant");
     V = Constant::getNullValue(Ty);
     return false;
   case ValID::t_None:
     if (!Ty->isTokenTy())
       return error(ID.Loc, "invalid type for none constant");
     V = Constant::getNullValue(Ty);
     return false;
+  case ValID::t_Poison:
+    // FIXME: LabelTy should not be a first-class type.
+    if (!Ty->isFirstClassType() || Ty->isLabelTy())
+      return error(ID.Loc, "invalid type for poison constant");
+    V = PoisonValue::get(Ty);
+    return false;
   case ValID::t_Constant:
     if (ID.ConstantVal->getType() != Ty)
       return error(ID.Loc, "constant expression type mismatch");
-
     V = ID.ConstantVal;
     return false;
   case ValID::t_ConstantStruct:
   case ValID::t_PackedConstantStruct:
     if (StructType *ST = dyn_cast<StructType>(Ty)) {
       if (ST->getNumElements() != ID.UIntVal)
         return error(ID.Loc,
                      "initializer with struct type has wrong # elements");

llvm/lib/AsmParser/LLToken.h

enum Kind {
   kw_extern_weak,
   kw_external,
   kw_thread_local,
   kw_localdynamic,
   kw_initialexec,
   kw_localexec,
   kw_zeroinitializer,
   kw_undef,
+  kw_poison,
   kw_null,
   kw_none,
   kw_to,
   kw_caller,
   kw_within,
   kw_from,
   kw_tail,
   kw_musttail,

llvm/lib/Bitcode/Reader/BitcodeReader.cpp

while (true) {
     Expected<unsigned> MaybeBitCode = Stream.readRecord(Entry.ID, Record);
     if (!MaybeBitCode)
       return MaybeBitCode.takeError();
     switch (unsigned BitCode = MaybeBitCode.get()) {
     default:  // Default behavior: unknown constant
     case bitc::CST_CODE_UNDEF:     // UNDEF
       V = UndefValue::get(CurTy);
       break;
+    case bitc::CST_CODE_POISON:    // POISON
+      V = PoisonValue::get(CurTy);
+      break;
     case bitc::CST_CODE_SETTYPE:   // SETTYPE: [typeid]
       if (Record.empty())
         return error("Invalid record");
       if (Record[0] >= TypeList.size() || !TypeList[Record[0]])
         return error("Invalid record");
       if (TypeList[Record[0]] == VoidType)
         return error("Invalid constant type");
       CurFullTy = TypeList[Record[0]];

llvm/lib/Bitcode/Writer/BitcodeWriter.cpp

if (const InlineAsm *IA = dyn_cast<InlineAsm>(V)) {
       Record.clear();
       continue;
     }
     const Constant *C = cast<Constant>(V);
     unsigned Code = -1U;
     unsigned AbbrevToUse = 0;
     if (C->isNullValue()) {
       Code = bitc::CST_CODE_NULL;
+    } else if (isa<PoisonValue>(C)) {
+      Code = bitc::CST_CODE_POISON;
     } else if (isa<UndefValue>(C)) {
       Code = bitc::CST_CODE_UNDEF;
     } else if (const ConstantInt *IV = dyn_cast<ConstantInt>(C)) {
       if (IV->getBitWidth() <= 64) {
         uint64_t V = IV->getSExtValue();
         emitSignedInt64(Record, V);
         Code = bitc::CST_CODE_INTEGER;
         AbbrevToUse = CONSTANTS_INTEGER_ABBREV;

llvm/lib/IR/AsmWriter.cpp

if (isa<ConstantPointerNull>(CV)) {
     return;
   }
 
   if (isa<ConstantTokenNone>(CV)) {
     Out << "none";
     return;
   }
 
+  if (isa<PoisonValue>(CV)) {
+    Out << "poison";
+    return;
+  }
+
   if (isa<UndefValue>(CV)) {
     Out << "undef";
     return;
   }
 
   if (const ConstantExpr *CE = dyn_cast<ConstantExpr>(CV)) {
     Out << CE->getOpcodeName();
     WriteOptimizationInfo(Out, CE);

llvm/lib/IR/Constants.cpp

unsigned UndefValue::getNumElements() const {
   if (auto *AT = dyn_cast<ArrayType>(Ty))
     return AT->getNumElements();
   if (auto *VT = dyn_cast<VectorType>(Ty))
     return cast<FixedVectorType>(VT)->getNumElements();
   return Ty->getStructNumElements();
 }
 
 //===----------------------------------------------------------------------===//
+//                         PoisonValue Implementation
+//===----------------------------------------------------------------------===//
+
+PoisonValue *PoisonValue::getSequentialElement() const {
+  if (ArrayType *ATy = dyn_cast<ArrayType>(getType()))
+    return PoisonValue::get(ATy->getElementType());
+  return PoisonValue::get(cast<VectorType>(getType())->getElementType());
+}
+
+PoisonValue *PoisonValue::getStructElement(unsigned Elt) const {
+  return PoisonValue::get(getType()->getStructElementType(Elt));
+}
+
+PoisonValue *PoisonValue::getElementValue(Constant *C) const {
+  if (isa<ArrayType>(getType()) || isa<VectorType>(getType()))
+    return getSequentialElement();
+  return getStructElement(cast<ConstantInt>(C)->getZExtValue());
+}
+
+PoisonValue *PoisonValue::getElementValue(unsigned Idx) const {
+  if (isa<ArrayType>(getType()) || isa<VectorType>(getType()))
+    return getSequentialElement();
+  return getStructElement(Idx);
+}
+
+//===----------------------------------------------------------------------===//
 //                            ConstantXXX Classes
 //===----------------------------------------------------------------------===//
 
 template <typename ItTy, typename EltTy>
 static bool rangeOnlyContains(ItTy Start, ItTy End, EltTy Elt) {
   for (; Start != End; ++Start)
     if (*Start != Elt)
       return false;

 }
 
 /// Remove the constant from the constant table.
 void UndefValue::destroyConstantImpl() {
   // Free the constant and any dangling references to it.
   getContext().pImpl->UVConstants.erase(getType());
 }
 
+PoisonValue *PoisonValue::get(Type *Ty) {
+  std::unique_ptr<PoisonValue> &Entry = Ty->getContext().pImpl->PVConstants[Ty];
+  if (!Entry)
+    Entry.reset(new PoisonValue(Ty));
+
+  return Entry.get();
+}
+
+/// Remove the constant from the constant table.
+void PoisonValue::destroyConstantImpl() {
+  // Free the constant and any dangling references to it.
+  getContext().pImpl->PVConstants.erase(getType());
+}
+
 BlockAddress *BlockAddress::get(BasicBlock *BB) {
   assert(BB->getParent() && "Block must have a parent");
   return get(BB->getParent(), BB);
 }
 
 BlockAddress *BlockAddress::get(Function *F, BasicBlock *BB) {
   BlockAddress *&BA =
     F->getContext().pImpl->BlockAddresses[std::make_pair(F, BB)];

llvm/lib/IR/Core.cpp

 LLVMValueRef LLVMConstAllOnes(LLVMTypeRef Ty) {
   return wrap(Constant::getAllOnesValue(unwrap(Ty)));
 }
 
 LLVMValueRef LLVMGetUndef(LLVMTypeRef Ty) {
   return wrap(UndefValue::get(unwrap(Ty)));
 }
 
+LLVMValueRef LLVMGetPoison(LLVMTypeRef Ty) {
+  return wrap(PoisonValue::get(unwrap(Ty)));
+}
+
 LLVMBool LLVMIsConstant(LLVMValueRef Ty) {
   return isa<Constant>(unwrap(Ty));
 }
 
 LLVMBool LLVMIsNull(LLVMValueRef Val) {
   if (Constant *C = dyn_cast<Constant>(unwrap(Val)))
     return C->isNullValue();
   return false;
 }
 
 LLVMBool LLVMIsUndef(LLVMValueRef Val) {
   return isa<UndefValue>(unwrap(Val));
 }
 
+LLVMBool LLVMIsPoison(LLVMValueRef Val) {
+  return isa<PoisonValue>(unwrap(Val));
+}
+
 LLVMValueRef LLVMConstPointerNull(LLVMTypeRef Ty) {
   return wrap(ConstantPointerNull::get(unwrap<PointerType>(Ty)));
 }
 
 /*--.. Operations on metadata nodes ........................................--*/
 
 LLVMMetadataRef LLVMMDStringInContext2(LLVMContextRef C, const char *Str,
                                        size_t SLen) {

llvm/lib/IR/LLVMContextImpl.h

#include "llvm/IR/Metadata.def"
 
   using VectorConstantsTy = ConstantUniqueMap<ConstantVector>;
   VectorConstantsTy VectorConstants;
 
   DenseMap<PointerType *, std::unique_ptr<ConstantPointerNull>> CPNConstants;
 
   DenseMap<Type *, std::unique_ptr<UndefValue>> UVConstants;
 
+  DenseMap<Type *, std::unique_ptr<PoisonValue>> PVConstants;
+
   StringMap<std::unique_ptr<ConstantDataSequential>> CDSConstants;
 
   DenseMap<std::pair<const Function *, const BasicBlock *>, BlockAddress *>
     BlockAddresses;
 
   DenseMap<const GlobalValue *, DSOLocalEquivalent *> DSOLocalEquivalents;
 
   ConstantUniqueMap<ConstantExpr> ExprConstants;

llvm/test/Bindings/OCaml/core.ml

let test_constants () =
   (* CHECK: const_undef{{.*}}undef
    *)
   group "undef";
   let c = undef i1_type in
   ignore (define_global "const_undef" c m);
   insist (i1_type = type_of c);
   insist (is_undef c);
 
+  (* CHECK: const_poison{{.*}}poison
+   *)
+  group "poison";
+  let c = poison i1_type in
+  ignore (define_global "const_poison" c m);
+  insist (i1_type = type_of c);
+  insist (is_poison c);
+
   group "constant arithmetic";
   (* CHECK: @const_neg = global i64 sub
    * CHECK: @const_nsw_neg = global i64 sub nsw
    * CHECK: @const_nuw_neg = global i64 sub nuw
    * CHECK: @const_fneg = global double fneg
    * CHECK: @const_not = global i64 xor
    * CHECK: @const_add = global i64 add
    * CHECK: @const_nsw_add = global i64 add nsw

llvm/test/Bitcode/compatibility.ll

 @const.false = constant i1 false
 ; CHECK: @const.false = constant i1 false
 @const.int = constant i32 zeroinitializer
 ; CHECK: @const.int = constant i32 0
 @const.float = constant double 0.0
 ; CHECK: @const.float = constant double 0.0
 @const.null = constant i8* null
 ; CHECK: @const.null = constant i8* null
-%const.struct.type = type { i32, i8 }
+%const.struct.type = type { i32, i8, i64 }
 %const.struct.type.packed = type <{ i32, i8 }>
[e-mail] = constant %const.struct.type { i32 -1, i8 undef }
-; CHECK: @const.struct = constant %const.struct.type { i32 -1, i8 undef }
[e-mail] = constant %const.struct.type { i32 -1, i8 undef, i64 poison }
+; CHECK: @const.struct = constant %const.struct.type { i32 -1, i8 undef, i64 poison }
 @const.struct.packed = constant %const.struct.type.packed <{ i32 -1, i8 1 }>
 ; CHECK: @const.struct.packed = constant %const.struct.type.packed <{ i32 -1, i8 1 }>
 
 ; CHECK: @constant.array.i8  = constant [3 x i8] c"\00\01\00"
 @constant.array.i8  = constant [3 x i8] [i8 -0, i8 1, i8 0]
 ; CHECK: @constant.array.i16 = constant [3 x i16] [i16 0, i16 1, i16 0]
 @constant.array.i16 = constant [3 x i16] [i16 -0, i16 1, i16 0]
 ; CHECK: @constant.array.i32 = constant [3 x i32] [i32 0, i32 1, i32 0]
defaultdest.2:
   ; CHECK: invoke fastcc void @f.fastcc()
          to label %defaultdest unwind label %exc
          ; CHECK: to label %defaultdest unwind label %exc
 exc:
   %cleanup = landingpad i32 cleanup
 
   resume i32 undef
   ; CHECK: resume i32 undef
+  resume i32 poison
+  ; CHECK: resume i32 poison
   unreachable
   ; CHECK: unreachable
 
   ret void
 }
 
 define i32 @instructions.win_eh.1() personality i32 -3 {
 entry:
define void @instructions.conversions() {
   fptrunc float undef to half
   ; CHECK: fptrunc float undef to half
   fpext half undef to float
   ; CHECK: fpext half undef to float
   fptoui float undef to i32
   ; CHECK: fptoui float undef to i32
   fptosi float undef to i32
   ; CHECK: fptosi float undef to i32
+  fptrunc float poison to half
+  ; CHECK: fptrunc float poison to half
+  fpext half poison to float
+  ; CHECK: fpext half poison to float
+  fptoui float poison to i32
+  ; CHECK: fptoui float poison to i32
+  fptosi float poison to i32
+  ; CHECK: fptosi float poison to i32
   uitofp i32 1 to float
   ; CHECK: uitofp i32 1 to float
   sitofp i32 -1 to float
   ; CHECK: sitofp i32 -1 to float
   ptrtoint i8* null to i64
   ; CHECK: ptrtoint i8* null to i64
   inttoptr i64 0 to i8*
   ; CHECK: inttoptr i64 0 to i8*

llvm/test/CodeGen/X86/poison-ops.ll

+; NOTE: This test case is borrowed from undef-ops.ll
+; RUN: llc < %s -mtriple=x86_64-unknown-unknown | FileCheck %s
+
+define i32 @add_poison_rhs(i32 %x) {
+; CHECK-LABEL: add_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = add i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @add_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: add_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = add <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @add_poison_lhs(i32 %x) {
+; CHECK-LABEL: add_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = add i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @add_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: add_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = add <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @sub_poison_rhs(i32 %x) {
+; CHECK-LABEL: sub_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = sub i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @sub_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: sub_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = sub <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @sub_poison_lhs(i32 %x) {
+; CHECK-LABEL: sub_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = sub i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @sub_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: sub_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = sub <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @mul_poison_rhs(i32 %x) {
+; CHECK-LABEL: mul_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = mul i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @mul_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: mul_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = mul <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @mul_poison_lhs(i32 %x) {
+; CHECK-LABEL: mul_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = mul i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @mul_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: mul_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = mul <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @sdiv_poison_rhs(i32 %x) {
+; CHECK-LABEL: sdiv_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = sdiv i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @sdiv_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: sdiv_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = sdiv <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @sdiv_poison_lhs(i32 %x) {
+; CHECK-LABEL: sdiv_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = sdiv i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @sdiv_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: sdiv_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = sdiv <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @udiv_poison_rhs(i32 %x) {
+; CHECK-LABEL: udiv_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = udiv i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @udiv_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: udiv_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = udiv <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @udiv_poison_lhs(i32 %x) {
+; CHECK-LABEL: udiv_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = udiv i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @udiv_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: udiv_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = udiv <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @srem_poison_rhs(i32 %x) {
+; CHECK-LABEL: srem_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = srem i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @srem_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: srem_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = srem <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @srem_poison_lhs(i32 %x) {
+; CHECK-LABEL: srem_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = srem i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @srem_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: srem_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = srem <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @urem_poison_rhs(i32 %x) {
+; CHECK-LABEL: urem_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = urem i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @urem_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: urem_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = urem <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @urem_poison_lhs(i32 %x) {
+; CHECK-LABEL: urem_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = urem i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @urem_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: urem_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = urem <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @ashr_poison_rhs(i32 %x) {
+; CHECK-LABEL: ashr_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = ashr i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @ashr_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: ashr_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = ashr <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @ashr_poison_lhs(i32 %x) {
+; CHECK-LABEL: ashr_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = ashr i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @ashr_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: ashr_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = ashr <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @lshr_poison_rhs(i32 %x) {
+; CHECK-LABEL: lshr_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = lshr i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @lshr_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: lshr_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = lshr <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @lshr_poison_lhs(i32 %x) {
+; CHECK-LABEL: lshr_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = lshr i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @lshr_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: lshr_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = lshr <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @shl_poison_rhs(i32 %x) {
+; CHECK-LABEL: shl_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = shl i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @shl_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: shl_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = shl <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @shl_poison_lhs(i32 %x) {
+; CHECK-LABEL: shl_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = shl i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @shl_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: shl_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = shl <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @and_poison_rhs(i32 %x) {
+; CHECK-LABEL: and_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = and i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @and_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: and_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = and <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @and_poison_lhs(i32 %x) {
+; CHECK-LABEL: and_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+  %r = and i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @and_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: and_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorps %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = and <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @or_poison_rhs(i32 %x) {
+; CHECK-LABEL: or_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    movl $-1, %eax
+; CHECK-NEXT:    retq
+  %r = or i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @or_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: or_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    pcmpeqd %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = or <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @or_poison_lhs(i32 %x) {
+; CHECK-LABEL: or_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    movl $-1, %eax
+; CHECK-NEXT:    retq
+  %r = or i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @or_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: or_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    pcmpeqd %xmm0, %xmm0
+; CHECK-NEXT:    retq
+  %r = or <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+define i32 @xor_poison_rhs(i32 %x) {
+; CHECK-LABEL: xor_poison_rhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = xor i32 %x, poison
+  ret i32 %r
+}
+
+define <4 x i32> @xor_poison_rhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: xor_poison_rhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = xor <4 x i32> %x, poison
+  ret <4 x i32> %r
+}
+
+define i32 @xor_poison_lhs(i32 %x) {
+; CHECK-LABEL: xor_poison_lhs:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = xor i32 poison, %x
+  ret i32 %r
+}
+
+define <4 x i32> @xor_poison_lhs_vec(<4 x i32> %x) {
+; CHECK-LABEL: xor_poison_lhs_vec:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %r = xor <4 x i32> poison, %x
+  ret <4 x i32> %r
+}
+
+; This would crash because the shift amount is an i8 operand,
+; but the result of the shift is i32. We can't just propagate
+; the existing poison as the result.
+
+define i1 @poison_operand_size_not_same_as_result() {
+; CHECK-LABEL: poison_operand_size_not_same_as_result:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    retq
+  %sh = shl i32 7, poison
+  %cmp = icmp eq i32 0, %sh
+  ret i1 %cmp
+}
+

llvm/tools/llvm-c-test/echo.cpp

static LLVMValueRef clone_constant_impl(LLVMValueRef Cst, LLVMModuleRef M) {
   }
 
   // Try undef
   if (LLVMIsUndef(Cst)) {
     check_value_kind(Cst, LLVMUndefValueValueKind);
     return LLVMGetUndef(TypeCloner(M).Clone(Cst));
   }
 
+  // Try poison
+  if (LLVMIsPoison(Cst)) {
+    check_value_kind(Cst, LLVMPoisonValueValueKind);
+    return LLVMGetPoison(TypeCloner(M).Clone(Cst));
+  }
+
   // Try null
   if (LLVMIsNull(Cst)) {
     check_value_kind(Cst, LLVMConstantTokenNoneValueKind);
     LLVMTypeRef Ty = TypeCloner(M).Clone(Cst);
     return LLVMConstNull(Ty);
   }
 
   // Try float literal