diff --git a/llvm/include/llvm/Analysis/ValueLattice.h b/llvm/include/llvm/Analysis/ValueLattice.h
--- a/llvm/include/llvm/Analysis/ValueLattice.h
+++ b/llvm/include/llvm/Analysis/ValueLattice.h
@@ -49,6 +49,11 @@
     /// The Value falls within this range. (Used only for integer typed values.)
     constantrange,
 
+    /// This Value contains a single element constant range and started out from
+    /// undef. Merging it with other constant ranges results in overdefined,
+    /// unless they match the single element constant range.
+    singlecrfromundef,
+
     /// We can not precisely model the dynamic values this value might take.
     overdefined
   };
@@ -75,6 +80,7 @@
     case unknown:
     case undef:
     case constant:
+    case singlecrfromundef:
     case notconstant:
       break;
     case constantrange:
@@ -105,6 +111,7 @@
 
     switch (Other.Tag) {
     case constantrange:
+    case singlecrfromundef:
       if (!isConstantRange())
         new (&Range) ConstantRange(Other.Range);
       else
@@ -157,8 +164,11 @@
   bool isUnknown() const { return Tag == unknown; }
   bool isUnknownOrUndef() const { return Tag == unknown || Tag == undef; }
   bool isConstant() const { return Tag == constant; }
+  bool isSingleCRFromUndef() const { return Tag == singlecrfromundef; }
   bool isNotConstant() const { return Tag == notconstant; }
-  bool isConstantRange() const { return Tag == constantrange; }
+  bool isConstantRange() const {
+    return Tag == constantrange || Tag == singlecrfromundef;
+  }
   bool isOverdefined() const { return Tag == overdefined; }
 
   Constant *getConstant() const {
@@ -253,6 +263,8 @@
       if (getConstantRange() == NewR)
         return false;
 
+      assert(!isSingleCRFromUndef());
+
       if (NewR.isEmptySet())
         return markOverdefined();
 
@@ -262,11 +274,11 @@
       return true;
     }
 
-    assert(isUnknown() || isUndef());
+    assert(isUnknown() || (isUndef() && NewR.isSingleElement()));
     if (NewR.isEmptySet())
       return markOverdefined();
 
-    Tag = constantrange;
+    Tag = isUnknown() ? constantrange : singlecrfromundef;
     new (&Range) ConstantRange(std::move(NewR));
     return true;
   }
@@ -323,7 +335,17 @@
       markOverdefined();
       return true;
     }
+
     ConstantRange NewR = getConstantRange().unionWith(RHS.getConstantRange());
+
+    if (isSingleCRFromUndef() || RHS.isSingleCRFromUndef()) {
+      if (NewR.isSingleElement()) {
+        assert(getConstantRange() == NewR);
+        return false;
+      }
+      markOverdefined();
+      return true;
+    }
     if (NewR.isFullSet())
       return markOverdefined();
     else if (NewR == getConstantRange())
diff --git a/llvm/lib/Analysis/ValueLattice.cpp b/llvm/lib/Analysis/ValueLattice.cpp
--- a/llvm/lib/Analysis/ValueLattice.cpp
+++ b/llvm/lib/Analysis/ValueLattice.cpp
@@ -19,6 +19,12 @@
 
   if (Val.isNotConstant())
     return OS << "notconstant<" << *Val.getNotConstant() << ">";
+
+  if (Val.isSingleCRFromUndef())
+    return OS << "constantrange (from undef)<"
+              << Val.getConstantRange().getLower() << ", "
+              << Val.getConstantRange().getUpper() << ">";
+
   if (Val.isConstantRange())
     return OS << "constantrange<" << Val.getConstantRange().getLower() << ", "
               << Val.getConstantRange().getUpper() << ">";
diff --git a/llvm/test/Transforms/CorrelatedValuePropagation/merge-range-and-undef.ll b/llvm/test/Transforms/CorrelatedValuePropagation/merge-range-and-undef.ll
--- a/llvm/test/Transforms/CorrelatedValuePropagation/merge-range-and-undef.ll
+++ b/llvm/test/Transforms/CorrelatedValuePropagation/merge-range-and-undef.ll
@@ -199,7 +199,8 @@
 ; CHECK-NEXT:    br label [[BB4]]
 ; CHECK:       bb4:
 ; CHECK-NEXT:    [[P:%.*]] = phi i64 [ undef, [[BB1]] ], [ 10, [[BB2]] ], [ [[R]], [[BB3]] ]
-; CHECK-NEXT:    ret i64 [[P]]
+; CHECK-NEXT:    [[RES:%.*]] = and i64 [[P]], 255
+; CHECK-NEXT:    ret i64 [[RES]]
 ;
 entry:
   br i1 %c1, label %bb1, label %bb2
diff --git a/llvm/test/Transforms/SCCP/range-and-ip.ll b/llvm/test/Transforms/SCCP/range-and-ip.ll
--- a/llvm/test/Transforms/SCCP/range-and-ip.ll
+++ b/llvm/test/Transforms/SCCP/range-and-ip.ll
@@ -1,8 +1,8 @@
 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt -S -ipsccp %s | FileCheck %s
 
-; FIXME: we cannot assume %r < 256 for @f1, because we pass undef at a call
-; site, which we won't eliminate.
+; Make sure we do not assume %r < 256 for @f1, because we pass undef
+; at a call site, which we won't eliminate.
 
 define i1 @constant_and_undef(i64 %a) {
 ; CHECK-LABEL: define {{.*}} @constant_and_undef(
@@ -14,7 +14,9 @@
 ; CHECK:       bb2:
 ; CHECK-NEXT:    [[RANGE:%.*]] = and i64 [[A:%.*]], 255
 ; CHECK-NEXT:    [[C_3:%.*]] = call i1 @f1(i64 [[RANGE]])
-; CHECK-NEXT:    ret i1 true
+; CHECK-NEXT:    [[R_1:%.*]] = and i1 [[C_1]], [[C_2]]
+; CHECK-NEXT:    [[R_2:%.*]] = and i1 [[R_1]], [[C_3]]
+; CHECK-NEXT:    ret i1 [[R_2]]
 ;
   %c.1 = call i1 @f1(i64 undef)
   br label %bb1
@@ -35,8 +37,9 @@
 
 define internal i1 @f1(i64 %r) {
 ; CHECK-LABEL: define {{.*}} @f1(
-; CHECK-NEXT:    call void @sideeffect(i1 true, i64 [[R:%.*]])
-; CHECK-NEXT:    ret i1 undef
+; CHECK-NEXT:    [[C:%.*]] = icmp ult i64 [[R:%.*]], 256
+; CHECK-NEXT:    call void @sideeffect(i1 [[C]], i64 [[R]])
+; CHECK-NEXT:    ret i1 [[C]]
 ;
   %c = icmp ult i64 %r, 256
   call void @sideeffect(i1 %c, i64 %r)