[InstSimplify] Allow isUndefValue(V) to return true if V is poison

[aqjune]

Summary

In the past, isUndefValue()/getWithoutUndef() was added to SimplifyQuery to avoid relying on an assumption that undef was folded into some constant in some cases.

For example, ExpandBinOp uses getWithoutUndef() because this can happen:

(1) Given undef & (1 ^ 1), ExpandBinOp first transforms it into (undef & 1) ^ (undef & 1) by distributivity.

(2) A first simplify call answers that the first (undef & 1) is 0 whereas another simplify call answers the second (undef & 1) is undef (this can happen when undefs are hidden under variables)

(3) Since 0 ^ undef = undef, ExpandBinOp returns undef.

However, this is incorrect because undef & (1 ^ 1) is 0 whereas the result is undef.
To avoid this, ExpandBinOp is calling subsequent queries with getWithoutUndef() applied to avoid folding undefs.

With poison, this transformation is now okay: poison & (1 ^ 1) is simply poison.

This patch

(1) renames isUndefValue() to isUndefOrPoison(), and

(2) let isUndefOrPoison() return true if the value is poison.

Considering the miscompilation due to the old ExpandBinOp in the past (https://reviews.llvm.org/D83360#2145746): if poison is used instead, it now becomes correct.

define i1 @src(i32 %x, i32 %y) {
%0:
  %cmp9.not.1 = icmp eq i32 %x, %y
  %cmp15 = icmp slt i32 %x, %y
  %spec.select39 = select i1 %cmp9.not.1, i1 poison, i1 %cmp15
  %spec.select40 = xor i1 %cmp9.not.1, 1
  %spec.select = and i1 %spec.select39, %spec.select40
  ret i1 %spec.select
}
=>
define i1 @tgt(i32 %x, i32 %y) {
%0:
  %cmp9.not.1 = icmp eq i32 %x, %y
  %cmp15 = icmp slt i32 %x, %y
  %spec.select39 = select i1 %cmp9.not.1, i1 poison, i1 %cmp15
  ret i1 %spec.select39
}
Transformation seems to be correct!

[nikic]

I don't think this change makes a lot of sense. I expect that in nearly all cases we'll be able to produce a better result by having a separate PoisonValue check beforehand (we'll want to return poison rather than undef or some other value). And if we do that, this change to the isUndefValue() API just makes things more confusing.

[reames]

I agree that this change makes the API (more) confusing.

[aqjune]

Well, okay. I'll make another patch for that.

[aqjune]

I'll make the next patch after http://llvm.org/pr48353 is resolved .

llvm/include/llvm/Analysis/InstructionSimplify.h

 //===-- InstructionSimplify.h - Fold instrs into simpler forms --*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
SimplifyQuery getWithInstruction(Instruction *I) const {
     return Copy;
   }
   SimplifyQuery getWithoutUndef() const {
     SimplifyQuery Copy(*this);
     Copy.CanUseUndef = false;
     return Copy;
   }
 
-  /// If CanUseUndef is true, returns whether \p V is undef.
-  /// Otherwise always return false.
-  bool isUndefValue(Value *V) const {
+  /// If CanUseUndef is true, returns true if \p V is undef or poison.
+  /// Otherwise, return true if V is poison.
+  bool isUndefOrPoison(Value *V) const {
+    if (isa<PoisonValue>(V))
+      return true;
     if (!CanUseUndef)
       return false;
     return isa<UndefValue>(V);
   }
 };
 
 // NOTE: the explicit multiple argument versions of these functions are
 // deprecated.

llvm/lib/Analysis/InstructionSimplify.cpp

 //===- InstructionSimplify.cpp - Fold instruction operands ----------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
static Value *ThreadBinOpOverSelect(Instruction::BinaryOps Opcode, Value *LHS,
   }
 
   // If they simplified to the same value, then return the common value.
   // If they both failed to simplify then return null.
   if (TV == FV)
     return TV;
 
   // If one branch simplified to undef, return the other one.
-  if (TV && Q.isUndefValue(TV))
+  if (TV && Q.isUndefOrPoison(TV))
     return FV;
-  if (FV && Q.isUndefValue(FV))
+  if (FV && Q.isUndefOrPoison(FV))
     return TV;
 
   // If applying the operation did not change the true and false select values,
   // then the result of the binop is the select itself.
   if (TV == SI->getTrueValue() && FV == SI->getFalseValue())
     return SI;
 
   // If one branch simplified and the other did not, and the simplified

 /// Given operands for an Add, see if we can fold the result.
 /// If not, this returns null.
 static Value *SimplifyAddInst(Value *Op0, Value *Op1, bool IsNSW, bool IsNUW,
                               const SimplifyQuery &Q, unsigned MaxRecurse) {
   if (Constant *C = foldOrCommuteConstant(Instruction::Add, Op0, Op1, Q))
     return C;
 
   // X + undef -> undef
-  if (Q.isUndefValue(Op1))
+  if (Q.isUndefOrPoison(Op1))
     return Op1;
 
   // X + 0 -> X
   if (match(Op1, m_Zero()))
     return Op0;
 
   // If two operands are negative, return 0.
   if (isKnownNegation(Op0, Op1))

 /// If not, this returns null.
 static Value *SimplifySubInst(Value *Op0, Value *Op1, bool isNSW, bool isNUW,
                               const SimplifyQuery &Q, unsigned MaxRecurse) {
   if (Constant *C = foldOrCommuteConstant(Instruction::Sub, Op0, Op1, Q))
     return C;
 
   // X - undef -> undef
   // undef - X -> undef
-  if (Q.isUndefValue(Op0) || Q.isUndefValue(Op1))
+  if (Q.isUndefOrPoison(Op0) || Q.isUndefOrPoison(Op1))
     return UndefValue::get(Op0->getType());
 
   // X - 0 -> X
   if (match(Op1, m_Zero()))
     return Op0;
 
   // X - X -> 0
   if (Op0 == Op1)

 /// If not, this returns null.
 static Value *SimplifyMulInst(Value *Op0, Value *Op1, const SimplifyQuery &Q,
                               unsigned MaxRecurse) {
   if (Constant *C = foldOrCommuteConstant(Instruction::Mul, Op0, Op1, Q))
     return C;
 
   // X * undef -> 0
   // X * 0 -> 0
-  if (Q.isUndefValue(Op1) || match(Op1, m_Zero()))
+  if (Q.isUndefOrPoison(Op1) || match(Op1, m_Zero()))
     return Constant::getNullValue(Op0->getType());
 
   // X * 1 -> X
   if (match(Op1, m_One()))
     return Op0;
 
   // (X / Y) * Y -> X if the division is exact.
   Value *X = nullptr;

 /// Check for common or similar folds of integer division or integer remainder.
 /// This applies to all 4 opcodes (sdiv/udiv/srem/urem).
 static Value *simplifyDivRem(Value *Op0, Value *Op1, bool IsDiv,
                              const SimplifyQuery &Q) {
   Type *Ty = Op0->getType();
 
   // X / undef -> undef
   // X % undef -> undef
-  if (Q.isUndefValue(Op1))
+  if (Q.isUndefOrPoison(Op1))
     return Op1;
 
   // X / 0 -> undef
   // X % 0 -> undef
   // We don't need to preserve faults!
   if (match(Op1, m_Zero()))
     return UndefValue::get(Ty);
 
   // If any element of a constant divisor fixed width vector is zero or undef,
   // the whole op is undef.
   auto *Op1C = dyn_cast<Constant>(Op1);
   auto *VTy = dyn_cast<FixedVectorType>(Ty);
   if (Op1C && VTy) {
     unsigned NumElts = VTy->getNumElements();
     for (unsigned i = 0; i != NumElts; ++i) {
       Constant *Elt = Op1C->getAggregateElement(i);
-      if (Elt && (Elt->isNullValue() || Q.isUndefValue(Elt)))
+      if (Elt && (Elt->isNullValue() || Q.isUndefOrPoison(Elt)))
         return UndefValue::get(Ty);
     }
   }
 
   // undef / X -> 0
   // undef % X -> 0
-  if (Q.isUndefValue(Op0))
+  if (Q.isUndefOrPoison(Op0))
     return Constant::getNullValue(Ty);
 
   // 0 / X -> 0
   // 0 % X -> 0
   if (match(Op0, m_Zero()))
     return Constant::getNullValue(Op0->getType());
 
   // X / X -> 1

 
 /// Returns true if a shift by \c Amount always yields undef.
 static bool isUndefShift(Value *Amount, const SimplifyQuery &Q) {
   Constant *C = dyn_cast<Constant>(Amount);
   if (!C)
     return false;
 
   // X shift by undef -> undef because it may shift by the bitwidth.
-  if (Q.isUndefValue(C))
+  if (Q.isUndefOrPoison(C))
     return true;
 
   // Shifting by the bitwidth or more is undefined.
   if (ConstantInt *CI = dyn_cast<ConstantInt>(C))
     if (CI->getValue().getLimitedValue() >=
         CI->getType()->getScalarSizeInBits())
       return true;
 
if (Value *V = SimplifyShift(Opcode, Op0, Op1, Q, MaxRecurse))
     return V;
 
   // X >> X -> 0
   if (Op0 == Op1)
     return Constant::getNullValue(Op0->getType());
 
   // undef >> X -> 0
   // undef >> X -> undef (if it's exact)
-  if (Q.isUndefValue(Op0))
+  if (Q.isUndefOrPoison(Op0))
     return isExact ? Op0 : Constant::getNullValue(Op0->getType());
 
   // The low bit cannot be shifted out of an exact shift if it is set.
   if (isExact) {
     KnownBits Op0Known = computeKnownBits(Op0, Q.DL, /*Depth=*/0, Q.AC, Q.CxtI, Q.DT);
     if (Op0Known.One[0])
       return Op0;
   }
 
   return nullptr;
 }
 
 /// Given operands for an Shl, see if we can fold the result.
 /// If not, this returns null.
 static Value *SimplifyShlInst(Value *Op0, Value *Op1, bool isNSW, bool isNUW,
                               const SimplifyQuery &Q, unsigned MaxRecurse) {
   if (Value *V = SimplifyShift(Instruction::Shl, Op0, Op1, Q, MaxRecurse))
     return V;
 
   // undef << X -> 0
   // undef << X -> undef if (if it's NSW/NUW)
-  if (Q.isUndefValue(Op0))
+  if (Q.isUndefOrPoison(Op0))
     return isNSW || isNUW ? Op0 : Constant::getNullValue(Op0->getType());
 
   // (X >> A) << A -> X
   Value *X;
   if (Q.IIQ.UseInstrInfo &&
       match(Op0, m_Exact(m_Shr(m_Value(X), m_Specific(Op1)))))
     return X;
 

 /// Given operands for an And, see if we can fold the result.
 /// If not, this returns null.
 static Value *SimplifyAndInst(Value *Op0, Value *Op1, const SimplifyQuery &Q,
                               unsigned MaxRecurse) {
   if (Constant *C = foldOrCommuteConstant(Instruction::And, Op0, Op1, Q))
     return C;
 
   // X & undef -> 0
-  if (Q.isUndefValue(Op1))
+  if (Q.isUndefOrPoison(Op1))
     return Constant::getNullValue(Op0->getType());
 
   // X & X = X
   if (Op0 == Op1)
     return Op0;
 
   // X & 0 = 0
   if (match(Op1, m_Zero()))

 static Value *SimplifyOrInst(Value *Op0, Value *Op1, const SimplifyQuery &Q,
                              unsigned MaxRecurse) {
   if (Constant *C = foldOrCommuteConstant(Instruction::Or, Op0, Op1, Q))
     return C;
 
   // X | undef -> -1
   // X | -1 = -1
   // Do not return Op1 because it may contain undef elements if it's a vector.
-  if (Q.isUndefValue(Op1) || match(Op1, m_AllOnes()))
+  if (Q.isUndefOrPoison(Op1) || match(Op1, m_AllOnes()))
     return Constant::getAllOnesValue(Op0->getType());
 
   // X | X = X
   // X | 0 = X
   if (Op0 == Op1 || match(Op1, m_Zero()))
     return Op0;
 
   // A | ~A  =  ~A | A  =  -1

 /// Given operands for a Xor, see if we can fold the result.
 /// If not, this returns null.
 static Value *SimplifyXorInst(Value *Op0, Value *Op1, const SimplifyQuery &Q,
                               unsigned MaxRecurse) {
   if (Constant *C = foldOrCommuteConstant(Instruction::Xor, Op0, Op1, Q))
     return C;
 
   // A ^ undef -> undef
-  if (Q.isUndefValue(Op1))
+  if (Q.isUndefOrPoison(Op1))
     return Op1;
 
   // A ^ 0 = A
   if (match(Op1, m_Zero()))
     return Op0;
 
   // A ^ A = 0
   if (Op0 == Op1)
static Value *SimplifyICmpInst(unsigned Predicate, Value *LHS, Value *RHS,
   }
   assert(!isa<UndefValue>(LHS) && "Unexpected icmp undef,%X");
 
   Type *ITy = GetCompareTy(LHS); // The return type.
 
   // For EQ and NE, we can always pick a value for the undef to make the
   // predicate pass or fail, so we can return undef.
   // Matches behavior in llvm::ConstantFoldCompareInstruction.
-  if (Q.isUndefValue(RHS) && ICmpInst::isEquality(Pred))
+  if (Q.isUndefOrPoison(RHS) && ICmpInst::isEquality(Pred))
     return UndefValue::get(ITy);
 
   // icmp X, X -> true/false
   // icmp X, undef -> true/false because undef could be X.
-  if (LHS == RHS || Q.isUndefValue(RHS))
+  if (LHS == RHS || Q.isUndefOrPoison(RHS))
     return ConstantInt::get(ITy, CmpInst::isTrueWhenEqual(Pred));
 
   if (Value *V = simplifyICmpOfBools(Pred, LHS, RHS, Q))
     return V;
 
   if (Value *V = simplifyICmpWithZero(Pred, LHS, RHS, Q))
     return V;
 
static Value *SimplifyFCmpInst(unsigned Predicate, Value *LHS, Value *RHS,
   // NaN is unordered; NaN is not ordered.
   assert((FCmpInst::isOrdered(Pred) || FCmpInst::isUnordered(Pred)) &&
          "Comparison must be either ordered or unordered");
   if (match(RHS, m_NaN()))
     return ConstantInt::get(RetTy, CmpInst::isUnordered(Pred));
 
   // fcmp pred x, undef  and  fcmp pred undef, x
   // fold to true if unordered, false if ordered
-  if (Q.isUndefValue(LHS) || Q.isUndefValue(RHS)) {
+  if (Q.isUndefOrPoison(LHS) || Q.isUndefOrPoison(RHS)) {
     // Choosing NaN for the undef will always make unordered comparison succeed
     // and ordered comparison fail.
     return ConstantInt::get(RetTy, CmpInst::isUnordered(Pred));
   }
 
   // fcmp x,x -> true/false.  Not all compares are foldable.
   if (LHS == RHS) {
     if (CmpInst::isTrueWhenEqual(Pred))

 static Value *SimplifySelectInst(Value *Cond, Value *TrueVal, Value *FalseVal,
                                  const SimplifyQuery &Q, unsigned MaxRecurse) {
   if (auto *CondC = dyn_cast<Constant>(Cond)) {
     if (auto *TrueC = dyn_cast<Constant>(TrueVal))
       if (auto *FalseC = dyn_cast<Constant>(FalseVal))
         return ConstantFoldSelectInstruction(CondC, TrueC, FalseC);
 
     // select undef, X, Y -> X or Y
-    if (Q.isUndefValue(CondC))
+    if (Q.isUndefOrPoison(CondC))
       return isa<Constant>(FalseVal) ? FalseVal : TrueVal;
 
     // TODO: Vector constants with undef elements don't simplify.
 
     // select true, X, Y  -> X
     if (CondC->isAllOnesValue())
       return TrueVal;
     // select false, X, Y -> Y
static Value *SimplifySelectInst(Value *Cond, Value *TrueVal, Value *FalseVal,
 
   // select ?, X, X -> X
   if (TrueVal == FalseVal)
     return TrueVal;
 
   // If the true or false value is undef, we can fold to the other value as
   // long as the other value isn't poison.
   // select ?, undef, X -> X
-  if (Q.isUndefValue(TrueVal) &&
+  if (Q.isUndefOrPoison(TrueVal) &&
       isGuaranteedNotToBeUndefOrPoison(FalseVal, Q.AC, Q.CxtI, Q.DT))
     return FalseVal;
   // select ?, X, undef -> X
-  if (Q.isUndefValue(FalseVal) &&
+  if (Q.isUndefOrPoison(FalseVal) &&
       isGuaranteedNotToBeUndefOrPoison(TrueVal, Q.AC, Q.CxtI, Q.DT))
     return TrueVal;
 
   // Deal with partial undef vector constants: select ?, VecC, VecC' --> VecC''
   Constant *TrueC, *FalseC;
   if (isa<FixedVectorType>(TrueVal->getType()) &&
       match(TrueVal, m_Constant(TrueC)) &&
       match(FalseVal, m_Constant(FalseC))) {
     unsigned NumElts =
         cast<FixedVectorType>(TrueC->getType())->getNumElements();
     SmallVector<Constant *, 16> NewC;
     for (unsigned i = 0; i != NumElts; ++i) {
       // Bail out on incomplete vector constants.
       Constant *TEltC = TrueC->getAggregateElement(i);
       Constant *FEltC = FalseC->getAggregateElement(i);
       if (!TEltC || !FEltC)
         break;
 
       // If the elements match (undef or not), that value is the result. If only
       // one element is undef, choose the defined element as the safe result.
       if (TEltC == FEltC)
         NewC.push_back(TEltC);
-      else if (Q.isUndefValue(TEltC) &&
+      else if (Q.isUndefOrPoison(TEltC) &&
                isGuaranteedNotToBeUndefOrPoison(FEltC))
         NewC.push_back(FEltC);
-      else if (Q.isUndefValue(FEltC) &&
+      else if (Q.isUndefOrPoison(FEltC) &&
                isGuaranteedNotToBeUndefOrPoison(TEltC))
         NewC.push_back(TEltC);
       else
         break;
     }
     if (NewC.size() == NumElts)
       return ConstantVector::get(NewC);
   }
static Value *SimplifyGEPInst(Type *SrcTy, ArrayRef<Value *> Ops,
   // Compute the (pointer) type returned by the GEP instruction.
   Type *LastType = GetElementPtrInst::getIndexedType(SrcTy, Ops.slice(1));
   Type *GEPTy = PointerType::get(LastType, AS);
   if (VectorType *VT = dyn_cast<VectorType>(Ops[0]->getType()))
     GEPTy = VectorType::get(GEPTy, VT->getElementCount());
   else if (VectorType *VT = dyn_cast<VectorType>(Ops[1]->getType()))
     GEPTy = VectorType::get(GEPTy, VT->getElementCount());
 
-  if (Q.isUndefValue(Ops[0]))
+  if (Q.isUndefOrPoison(Ops[0]))
     return UndefValue::get(GEPTy);
 
   bool IsScalableVec = isa<ScalableVectorType>(SrcTy);
 
   if (Ops.size() == 2) {
     // getelementptr P, 0 -> P.
     if (match(Ops[1], m_Zero()) && Ops[0]->getType() == GEPTy)
       return Ops[0];

 static Value *SimplifyInsertValueInst(Value *Agg, Value *Val,
                                       ArrayRef<unsigned> Idxs, const SimplifyQuery &Q,
                                       unsigned) {
   if (Constant *CAgg = dyn_cast<Constant>(Agg))
     if (Constant *CVal = dyn_cast<Constant>(Val))
       return ConstantFoldInsertValueInstruction(CAgg, CVal, Idxs);
 
   // insertvalue x, undef, n -> x
-  if (Q.isUndefValue(Val))
+  if (Q.isUndefOrPoison(Val))
     return Agg;
 
   // insertvalue x, (extractvalue y, n), n
   if (ExtractValueInst *EV = dyn_cast<ExtractValueInst>(Val))
     if (EV->getAggregateOperand()->getType() == Agg->getType() &&
         EV->getIndices() == Idxs) {
       // insertvalue undef, (extractvalue y, n), n -> y
-      if (Q.isUndefValue(Agg))
+      if (Q.isUndefOrPoison(Agg))
         return EV->getAggregateOperand();
 
       // insertvalue y, (extractvalue y, n), n -> y
       if (Agg == EV->getAggregateOperand())
         return Agg;
     }
 
   return nullptr;
Value *llvm::SimplifyInsertElementInst(Value *Vec, Value *Val, Value *Idx,
   // For fixed-length vector, fold into undef if index is out of bounds.
   if (auto *CI = dyn_cast<ConstantInt>(Idx)) {
     if (isa<FixedVectorType>(Vec->getType()) &&
         CI->uge(cast<FixedVectorType>(Vec->getType())->getNumElements()))
       return UndefValue::get(Vec->getType());
   }
 
   // If index is undef, it might be out of bounds (see above case)
-  if (Q.isUndefValue(Idx))
+  if (Q.isUndefOrPoison(Idx))
     return UndefValue::get(Vec->getType());
 
   // If the scalar is undef, and there is no risk of propagating poison from the
   // vector value, simplify to the vector value.
-  if (Q.isUndefValue(Val) &&
+  if (Q.isUndefOrPoison(Val) &&
       isGuaranteedNotToBeUndefOrPoison(Vec))
     return Vec;
 
   // If we are extracting a value from a vector, then inserting it into the same
   // place, that's the input vector:
   // insertelt Vec, (extractelt Vec, Idx), Idx --> Vec
   if (match(Val, m_ExtractElt(m_Specific(Vec), m_Specific(Idx))))
     return Vec;
static Value *SimplifyExtractElementInst(Value *Vec, Value *Idx,
   if (auto *CVec = dyn_cast<Constant>(Vec)) {
     if (auto *CIdx = dyn_cast<Constant>(Idx))
       return ConstantExpr::getExtractElement(CVec, CIdx);
 
     // The index is not relevant if our vector is a splat.
     if (auto *Splat = CVec->getSplatValue())
       return Splat;
 
-    if (Q.isUndefValue(Vec))
+    if (Q.isUndefOrPoison(Vec))
       return UndefValue::get(VecVTy->getElementType());
   }
 
   // If extracting a specified index from the vector, see if we can recursively
   // find a previously computed scalar that was inserted into the vector.
   if (auto *IdxC = dyn_cast<ConstantInt>(Idx)) {
     // For fixed-length vector, fold into undef if index is out of bounds.
     if (isa<FixedVectorType>(VecVTy) &&
         IdxC->getValue().uge(cast<FixedVectorType>(VecVTy)->getNumElements()))
       return UndefValue::get(VecVTy->getElementType());
     if (Value *Elt = findScalarElement(Vec, IdxC->getZExtValue()))
       return Elt;
   }
 
   // An undef extract index can be arbitrarily chosen to be an out-of-range
   // index value, which would result in the instruction being undef.
-  if (Q.isUndefValue(Idx))
+  if (Q.isUndefOrPoison(Idx))
     return UndefValue::get(VecVTy->getElementType());
 
   return nullptr;
 }
 
 Value *llvm::SimplifyExtractElementInst(Value *Vec, Value *Idx,
                                         const SimplifyQuery &Q) {
   return ::SimplifyExtractElementInst(Vec, Idx, Q, RecursionLimit);
 }
 
 /// See if we can fold the given phi. If not, returns null.
 static Value *SimplifyPHINode(PHINode *PN, const SimplifyQuery &Q) {
   // WARNING: no matter how worthwhile it may seem, we can not perform PHI CSE
   //          here, because the PHI we may succeed simplifying to was not
   //          def-reachable from the original PHI!
 
   // If all of the PHI's incoming values are the same then replace the PHI node
   // with the common value.
   Value *CommonValue = nullptr;
   bool HasUndefInput = false;
   for (Value *Incoming : PN->incoming_values()) {
     // If the incoming value is the phi node itself, it can safely be skipped.
     if (Incoming == PN) continue;
-    if (Q.isUndefValue(Incoming)) {
+    if (Q.isUndefOrPoison(Incoming)) {
       // Remember that we saw an undef value, but otherwise ignore them.
       HasUndefInput = true;
       continue;
     }
     if (CommonValue && Incoming != CommonValue)
       return nullptr;  // Not the same, bail out.
     CommonValue = Incoming;
   }
if (all_of(Indices, [InsertIndex](int MaskElt) {
           VecC[i] = UndefValue::get(C->getType());
       return ConstantVector::get(VecC);
     }
   }
 
   // A shuffle of a splat is always the splat itself. Legal if the shuffle's
   // value type is same as the input vectors' type.
   if (auto *OpShuf = dyn_cast<ShuffleVectorInst>(Op0))
-    if (Q.isUndefValue(Op1) && RetTy == InVecTy &&
+    if (Q.isUndefOrPoison(Op1) && RetTy == InVecTy &&
         is_splat(OpShuf->getShuffleMask()))
       return Op0;
 
   // All remaining transformation depend on the value of the mask, which is
   // not known at compile time for scalable vectors.
   if (Scalable)
     return nullptr;
 

 /// transforms based on undef/NaN because the operation itself makes no
 /// difference to the result.
 static Constant *simplifyFPOp(ArrayRef<Value *> Ops,
                               FastMathFlags FMF,
                               const SimplifyQuery &Q) {
   for (Value *V : Ops) {
     bool IsNan = match(V, m_NaN());
     bool IsInf = match(V, m_Inf());
-    bool IsUndef = Q.isUndefValue(V);
+    bool IsUndef = Q.isUndefOrPoison(V);
 
     // If this operation has 'nnan' or 'ninf' and at least 1 disallowed operand
     // (an undef operand can be chosen to be Nan/Inf), then the result of
     // this operation is poison. That result can be relaxed to undef.
     if (FMF.noNaNs() && (IsNan || IsUndef))
       return UndefValue::get(V->getType());
     if (FMF.noInfs() && (IsInf || IsUndef))
       return UndefValue::get(V->getType());
case Intrinsic::umin: {
     if (Op0 == Op1)
       return Op0;
 
     // Canonicalize constant operand as Op1.
     if (isa<Constant>(Op0))
       std::swap(Op0, Op1);
 
     // Assume undef is the limit value.
-    if (Q.isUndefValue(Op1))
+    if (Q.isUndefOrPoison(Op1))
       return ConstantInt::get(ReturnType, getMaxMinLimit(IID, BitWidth));
 
     const APInt *C;
     if (match(Op1, m_APIntAllowUndef(C))) {
       // Clamp to limit value. For example:
       // umax(i8 %x, i8 255) --> 255
       if (*C == getMaxMinLimit(IID, BitWidth))
         return ConstantInt::get(ReturnType, *C);
if (Op0 == Op1)
       return Constant::getNullValue(ReturnType);
     LLVM_FALLTHROUGH;
   case Intrinsic::uadd_with_overflow:
   case Intrinsic::sadd_with_overflow:
     // X - undef -> { undef, false }
     // undef - X -> { undef, false }
     // X + undef -> { undef, false }
     // undef + x -> { undef, false }
-    if (Q.isUndefValue(Op0) || Q.isUndefValue(Op1)) {
+    if (Q.isUndefOrPoison(Op0) || Q.isUndefOrPoison(Op1)) {
       return ConstantStruct::get(
           cast<StructType>(ReturnType),
           {UndefValue::get(ReturnType->getStructElementType(0)),
            Constant::getNullValue(ReturnType->getStructElementType(1))});
     }
     break;
   case Intrinsic::umul_with_overflow:
   case Intrinsic::smul_with_overflow:
     // 0 * X -> { 0, false }
     // X * 0 -> { 0, false }
     if (match(Op0, m_Zero()) || match(Op1, m_Zero()))
       return Constant::getNullValue(ReturnType);
     // undef * X -> { 0, false }
     // X * undef -> { 0, false }
-    if (Q.isUndefValue(Op0) || Q.isUndefValue(Op1))
+    if (Q.isUndefOrPoison(Op0) || Q.isUndefOrPoison(Op1))
       return Constant::getNullValue(ReturnType);
     break;
   case Intrinsic::uadd_sat:
     // sat(MAX + X) -> MAX
     // sat(X + MAX) -> MAX
     if (match(Op0, m_AllOnes()) || match(Op1, m_AllOnes()))
       return Constant::getAllOnesValue(ReturnType);
     LLVM_FALLTHROUGH;
   case Intrinsic::sadd_sat:
     // sat(X + undef) -> -1
     // sat(undef + X) -> -1
     // For unsigned: Assume undef is MAX, thus we saturate to MAX (-1).
     // For signed: Assume undef is ~X, in which case X + ~X = -1.
-    if (Q.isUndefValue(Op0) || Q.isUndefValue(Op1))
+    if (Q.isUndefOrPoison(Op0) || Q.isUndefOrPoison(Op1))
       return Constant::getAllOnesValue(ReturnType);
 
     // X + 0 -> X
     if (match(Op1, m_Zero()))
       return Op0;
     // 0 + X -> X
     if (match(Op0, m_Zero()))
       return Op1;
     break;
   case Intrinsic::usub_sat:
     // sat(0 - X) -> 0, sat(X - MAX) -> 0
     if (match(Op0, m_Zero()) || match(Op1, m_AllOnes()))
       return Constant::getNullValue(ReturnType);
     LLVM_FALLTHROUGH;
   case Intrinsic::ssub_sat:
     // X - X -> 0, X - undef -> 0, undef - X -> 0
-    if (Op0 == Op1 || Q.isUndefValue(Op0) || Q.isUndefValue(Op1))
+    if (Op0 == Op1 || Q.isUndefOrPoison(Op0) || Q.isUndefOrPoison(Op1))
       return Constant::getNullValue(ReturnType);
     // X - 0 -> X
     if (match(Op1, m_Zero()))
       return Op0;
     break;
   case Intrinsic::load_relative:
     if (auto *C0 = dyn_cast<Constant>(Op0))
       if (auto *C1 = dyn_cast<Constant>(Op1))
case Intrinsic::minimum: {
     // If the arguments are the same, this is a no-op.
     if (Op0 == Op1) return Op0;
 
     // Canonicalize constant operand as Op1.
     if (isa<Constant>(Op0))
       std::swap(Op0, Op1);
 
     // If an argument is undef, return the other argument.
-    if (Q.isUndefValue(Op1))
+    if (Q.isUndefOrPoison(Op1))
       return Op0;
 
     bool PropagateNaN = IID == Intrinsic::minimum || IID == Intrinsic::maximum;
     bool IsMin = IID == Intrinsic::minimum || IID == Intrinsic::minnum;
 
     // minnum(X, nan) -> X
     // maxnum(X, nan) -> X
     // minimum(X, nan) -> nan
case Intrinsic::masked_gather: {
     return nullptr;
   }
   case Intrinsic::fshl:
   case Intrinsic::fshr: {
     Value *Op0 = Call->getArgOperand(0), *Op1 = Call->getArgOperand(1),
           *ShAmtArg = Call->getArgOperand(2);
 
     // If both operands are undef, the result is undef.
-    if (Q.isUndefValue(Op0) && Q.isUndefValue(Op1))
+    if (Q.isUndefOrPoison(Op0) && Q.isUndefOrPoison(Op1))
       return UndefValue::get(F->getReturnType());
 
     // If shift amount is undef, assume it is zero.
-    if (Q.isUndefValue(ShAmtArg))
+    if (Q.isUndefOrPoison(ShAmtArg))
       return Call->getArgOperand(IID == Intrinsic::fshl ? 0 : 1);
 
     const APInt *ShAmtC;
     if (match(ShAmtArg, m_APInt(ShAmtC))) {
       // If there's effectively no shift, return the 1st arg or 2nd arg.
       APInt BitWidth = APInt(ShAmtC->getBitWidth(), ShAmtC->getBitWidth());
       if (ShAmtC->urem(BitWidth).isNullValue())
         return Call->getArgOperand(IID == Intrinsic::fshl ? 0 : 1);

llvm/test/Transforms/InstSimplify/select.ll

;
   %cmp9.not.1 = icmp eq i32 %x, %y
   %cmp15 = icmp slt i32 %x, %y
   %spec.select39 = select i1 %cmp9.not.1, i1 undef, i1 %cmp15
   %spec.select40 = xor i1 %cmp9.not.1, 1
   %spec.select  = and i1 %spec.select39, %spec.select40
   ret i1 %spec.select
 }
 
+define i1 @expand_binop_poison(i32 %x, i32 %y) {
+; CHECK-LABEL: @expand_binop_poison(
+; CHECK-NEXT:    [[CMP9_NOT_1:%.*]] = icmp eq i32 [[X:%.*]], [[Y:%.*]]
+; CHECK-NEXT:    [[CMP15:%.*]] = icmp slt i32 [[X]], [[Y]]
+; CHECK-NEXT:    [[SPEC_SELECT39:%.*]] = select i1 [[CMP9_NOT_1]], i1 poison, i1 [[CMP15]]
+; CHECK-NEXT:    ret i1 [[SPEC_SELECT39]]
+;
+  %cmp9.not.1 = icmp eq i32 %x, %y
+  %cmp15 = icmp slt i32 %x, %y
+  %spec.select39 = select i1 %cmp9.not.1, i1 poison, i1 %cmp15
+  %spec.select40 = xor i1 %cmp9.not.1, 1
+  %spec.select  = and i1 %spec.select39, %spec.select40
+  ret i1 %spec.select
+}
+
 define i32 @pr47322_more_poisonous_replacement(i32 %arg) {
 ; CHECK-LABEL: @pr47322_more_poisonous_replacement(
 ; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[ARG:%.*]], 0
 ; CHECK-NEXT:    [[TRAILING:%.*]] = call i32 @llvm.cttz.i32(i32 [[ARG]], i1 immarg true)
 ; CHECK-NEXT:    [[SHIFTED:%.*]] = lshr i32 [[ARG]], [[TRAILING]]
 ; CHECK-NEXT:    [[R1_SROA_0_1:%.*]] = select i1 [[CMP]], i32 0, i32 [[SHIFTED]]
 ; CHECK-NEXT:    ret i32 [[R1_SROA_0_1]]
 ;