Add a ConstraintAnalysis pass

src/ir/constraint.cpp

@@ -153,4 +153,81 @@ void AndedConstraintSet::approximateOr(const AndedConstraintSet& other) {
   clear();
 }
 
+std::optional<LocalConstraint> LocalConstraint::parse(Expression* curr) {
+  auto parseEqZ = [&](Expression* value) -> std::optional<LocalConstraint> {
+    if (auto* get = value->dynCast<LocalGet>()) {
+      // Canonicalize EqZ to Eq of 0.
+      auto value = Literal::makeZero(get->type);
+      return LocalConstraint{get->index, Constraint{Abstract::Eq, {value}}};
+    }
+    return {};
+  };
+
+  if (auto* unary = curr->dynCast<Unary>()) {
+    if (Abstract::getUnary(unary->type, Abstract::EqZ) == unary->op) {
+      return parseEqZ(unary->value);
+    }
+    return {};
+  }
+
+  if (auto* refIsNull = curr->dynCast<RefIsNull>()) {
+    return parseEqZ(refIsNull->value);
+  }
+
+  // Parse a get or a constant.
+  auto parseTerm = [&](Expression* expr) -> std::optional<Term> {
+    if (auto* get = expr->dynCast<LocalGet>()) {
+      return Term{get->index};
+    }
+    if (Properties::isSingleConstantExpression(expr)) {
+      return Term{Properties::getLiteral(expr)};
+    }
+    return {};
+  };
+
+  auto parseBinary = [&](Abstract::Op op,
+                         Expression* left,
+                         Expression* right) -> std::optional<LocalConstraint> {
+    // The left must be a get.
+    if (auto* get = left->dynCast<LocalGet>()) {
+      // The right can be any term.
+      if (auto value = parseTerm(right)) {
+        return LocalConstraint{get->index, Constraint{op, *value}};
+      }
+    }
+    return {};
+  };
+
+  if (auto* binary = curr->dynCast<Binary>()) {
+    // The operation must be one we recognize.
+    for (auto op : {Abstract::Eq, Abstract::Ne}) {
+      if (Abstract::getBinary(binary->type, op) == binary->op) {
+        return parseBinary(op, binary->left, binary->right);
+      }
+    }
+    return {};
+  }
+
+  if (auto* refEq = curr->dynCast<RefEq>()) {
+    return parseBinary(Abstract::Eq, refEq->left, refEq->right);
+  }
+
+  return {};
+}
+
+void LocalConstraintMap::approximateOr(const LocalConstraintMap& other) {
+  // Find things in both, and OR them.
+  for (auto& [local, constraints] : other) {
+    if (auto iter = find(local); iter != end()) {
+      iter->second.approximateOr(constraints);
+    }
+  }
+
+  // Remove things only in us.
+  std::erase_if(*this, [&](const auto& item) {
+    const auto& [local, constraints] = item;
+    return !other.contains(local);
+  });
+}
+
 } // namespace wasm::constraint

src/ir/constraint.h

@@ -121,6 +121,31 @@ struct AndedConstraintSet : inplace_vector<Constraint, MaxConstraints> {
   void approximateOr(const AndedConstraintSet& other);
 };
 
+// A local plus a constraint on it.
+struct LocalConstraint {
+  Index local;
+  Constraint constraint;
+
+  // Try to parse BinaryenIR into a local to which a constraint is applied. For
+  // example
+  //
+  //   (i32.eq (local.get $r) (i32.const 10))
+  //
+  // parses into
+  //
+  //   LocalConstraint($r, { x == 10 })
+  //
+  static std::optional<LocalConstraint> parse(Expression* curr);
+};
+
+// A map of locals and their constraints.
+struct LocalConstraintMap
+  : public std::unordered_map<Index, AndedConstraintSet> {
+  // Perform an OR as above on each local that appears in both maps. If a local
+  // appears only in one, we can infer nothing, and drop it.
+  void approximateOr(const LocalConstraintMap& other);
+};
+
 } // namespace wasm::constraint
 
 #endif // wasm_ir_constraint_h

src/passes/CMakeLists.txt

@@ -26,6 +26,7 @@ set(passes_SOURCES
   CodeFolding.cpp
   ConstantFieldPropagation.cpp
   ConstHoisting.cpp
+  ConstraintAnalysis.cpp
   DataFlowOpts.cpp
   DeadArgumentElimination.cpp
   DeadArgumentElimination2.cpp

src/passes/ConstraintAnalysis.cpp

@@ -0,0 +1,224 @@
+/*
+ * Copyright 2026 WebAssembly Community Group participants
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//
+// Use mathematical constraint solving to optimize. For example:
+//
+//  if (x == 10) {
+//    assert(x != 0); // redundant and can be removed.
+//  }
+//
+
+#include "cfg/cfg-traversal.h"
+#include "ir/constraint.h"
+#include "ir/drop.h"
+#include "ir/literal-utils.h"
+#include "ir/local-graph.h"
+#include "ir/properties.h"
+#include "pass.h"
+#include "support/unique_deferring_queue.h"
+#include "support/utilities.h"
+#include "wasm-builder.h"
+#include "wasm.h"
+
+namespace wasm {
+
+using namespace wasm::constraint;
+
+namespace {
+
+// In each basic block we will store the relevant operations, which are all
+// local gets and sets, branches, and uses of them.
+struct Info {
+  std::vector<Expression**> actions;
+
+  // For each local index, we track the constraints we know about it. We only do
+  // so at the end of each block, which is enough for the analysis below.
+  LocalConstraintMap endConstraints;
+};
+
+struct ConstraintAnalysis
+  : public WalkerPass<
+      CFGWalker<ConstraintAnalysis, Visitor<ConstraintAnalysis>, Info>> {
+  bool isFunctionParallel() override { return true; }
+
+  // Locals are not modified here.
+  bool requiresNonNullableLocalFixups() override { return false; }
+
+  std::unique_ptr<Pass> create() override {
+    return std::make_unique<ConstraintAnalysis>();
+  }
+
+  // Branches outside of the function can be ignored, as we only look at local
+  // state in the function.
+  bool ignoreBranchesOutsideOfFunc = true;
+
+  // Store the actions we care about.
+  void addAction() {
+    if (currBasicBlock) {
+      currBasicBlock->contents.actions.push_back(getCurrentPointer());
+    }
+  }
+
+  void visitLocalSet(LocalSet* curr) { addAction(); }
+  void visitUnary(Unary* curr) { addAction(); }
+  void visitBinary(Binary* curr) { addAction(); }
+  void visitRefEq(RefEq* curr) { addAction(); }
+  void visitRefIsNull(RefIsNull* curr) { addAction(); }
+
+  void visitFunction(Function* curr) {
+    // TODO: optimize for speed, find relevant locals etc.
+    flow();
+    optimize();
+  }
+
+  // Flow infos around until we have inferred all we can about the constraints
+  // in each location.
+  void flow() {
+    // Start from all the blocks, and keep going while we find something new.
+    UniqueDeferredQueue<BasicBlock*> work;
+    for (auto& block : basicBlocks) {
+      work.push(block.get());
+    }
+    while (!work.empty()) {
+      auto* block = work.pop();
+
+      // Merge incoming data to get the status at the start of the block.
+      LocalConstraintMap constraints = mergeIncoming(block);
+
+      // Go through the block, applying things.
+      for (auto** currp : block->contents.actions) {
+        applyToConstraints(*currp, constraints);
+      }
+
+      // We now know the values at the end of the block. If something changed,
+      // flow it onward.
+      if (constraints != block->contents.endConstraints) {
+        block->contents.endConstraints = std::move(constraints);
+        for (auto* out : block->out) {
+          work.push(out);
+        }
+      }
+    }
+  }
+
+  // After inferring all we can, apply it to optimize the code.
+  void optimize() {
+    for (auto& block : basicBlocks) {
+      // Follow the general shape of flow(): we need to see what the state is
+      // at each intermediate point inside the block. (Flowing between blocks is
+      // of course not needed at this stage.)
+      LocalConstraintMap constraints = mergeIncoming(block.get());
+      for (auto** currp : block->contents.actions) {
+        applyToConstraints(*currp, constraints);
+        optimizeExpression(currp, constraints);
+      }
+    }
+  }
+
+  // Given an expression and the constraints on it, optimize it.
+  void optimizeExpression(Expression** currp,
+                          const LocalConstraintMap& constraints) {
+    auto* curr = *currp;
+    auto parsed = LocalConstraint::parse(curr);
+    if (!parsed) {
+      return;
+    }
+
+    auto iter = constraints.find(parsed->local);
+    if (iter == constraints.end()) {
+      return;
+    }
+    auto& localConstraints = iter->second;
+    Result result = localConstraints.proves(parsed->constraint);
+    if (result == Unknown) {
+      // If we parsed something using two locals, like x != y, we can also look
+      // for the flipped condition among y's constraints TODO
+      return;
+    }
+
+    // We know the result!
+    auto& wasm = *getModule();
+    auto value =
+      LiteralUtils::makeFromInt32(result == True ? 1 : 0, curr->type, wasm);
+    *currp = getDroppedChildrenAndAppend(
+      curr, wasm, getPassOptions(), value, DropMode::IgnoreParentEffects);
+  }
+
+  // Merge incoming data to a block, by looking at the data arriving from each
+  // of the predecessor blocks.
+  LocalConstraintMap mergeIncoming(BasicBlock* block) {
+    LocalConstraintMap constraints;
+
+    // Merge all preds.
+    for (auto* pred : block->in) {
+      auto& predConstraints = getConstraintsFromPredToSucc(pred, block);
+      if (pred == *block->in.begin()) {
+        // This is the first. Just copy.
+        constraints = predConstraints;
+      } else {
+        // Merge in subsequent ones.
+        constraints.approximateOr(predConstraints);
+      }
+    }
+
+    // The entry block has incoming values - defaults - for each var.
+    if (block == entry) {
+      auto* func = getFunction();
+      auto numLocals = func->getNumLocals();
+      for (Index i = 0; i < numLocals; i++) {
+        if (!func->isVar(i)) {
+          continue;
+        }
+        auto type = func->getLocalType(i);
+        // TODO: support tuples
+        if (type.size() == 1 && LiteralUtils::canMakeZero(type)) {
+          auto value = Literal::makeZero(type);
+          constraints[i].approximateAnd(Constraint{Abstract::Eq, {value}});
+        }
+      }
+    }
+
+    return constraints;
+  }
+
+  // Given a source (predecessor) and a target (successor) block, find the
+  // constraints for locals as they arrive to that target from that successor.
+  const LocalConstraintMap& getConstraintsFromPredToSucc(BasicBlock* pred,
+                                                         BasicBlock* block) {
+    // TODO: use conditional branching to send different values along branches
+    return pred->contents.endConstraints;
+  }
+
+  // Given an expression, apply it to the constraints. For example, a local.set
+  // sets the value for that local.
+  void applyToConstraints(Expression* curr, LocalConstraintMap& constraints) {
+    if (auto* set = curr->dynCast<LocalSet>()) {
+      auto& localConstraints = constraints[set->index];
+      localConstraints.clear();
+      if (Properties::isSingleConstantExpression(set->value)) {
+        auto value = Properties::getLiteral(set->value);
+        localConstraints.approximateAnd(Constraint{Abstract::Eq, {value}});
+      }
+    }
+  }
+};
+
+} // anonymous namespace
+
+Pass* createConstraintAnalysisPass() { return new ConstraintAnalysis(); }
+
+} // namespace wasm

src/passes/pass.cpp

@@ -129,6 +129,9 @@ void PassRegistry::registerPasses() {
   registerPass("cfp-reftest",
                "propagate constant struct field values, using ref.test",
                createConstantFieldPropagationRefTestPass);
+  registerPass("constraint-analysis",
+               "finds and uses mathematical constraints on locals",
+               createConstraintAnalysisPass);
   registerPass(
     "dce", "removes unreachable code", createDeadCodeEliminationPass);
   registerPass("dealign",

src/passes/passes.h

@@ -33,6 +33,7 @@ Pass* createCodePushingPass();
 Pass* createConstHoistingPass();
 Pass* createConstantFieldPropagationPass();
 Pass* createConstantFieldPropagationRefTestPass();
+Pass* createConstraintAnalysisPass();
 Pass* createDAEPass();
 Pass* createDAEOptimizingPass();
 Pass* createDAE2Pass();

test/lit/help/wasm-metadce.test

@@ -109,6 +109,9 @@
 ;; CHECK-NEXT:   --const-hoisting                              hoist repeated constants to a
 ;; CHECK-NEXT:                                                 local
 ;; CHECK-NEXT:
+;; CHECK-NEXT:   --constraint-analysis                         finds and uses mathematical
+;; CHECK-NEXT:                                                 constraints on locals
+;; CHECK-NEXT:
 ;; CHECK-NEXT:   --dae                                         removes arguments to calls in an
 ;; CHECK-NEXT:                                                 lto-like manner
 ;; CHECK-NEXT:

test/lit/help/wasm-opt.test

@@ -145,6 +145,9 @@
 ;; CHECK-NEXT:   --const-hoisting                              hoist repeated constants to a
 ;; CHECK-NEXT:                                                 local
 ;; CHECK-NEXT:
+;; CHECK-NEXT:   --constraint-analysis                         finds and uses mathematical
+;; CHECK-NEXT:                                                 constraints on locals
+;; CHECK-NEXT:
 ;; CHECK-NEXT:   --dae                                         removes arguments to calls in an
 ;; CHECK-NEXT:                                                 lto-like manner
 ;; CHECK-NEXT:

test/lit/help/wasm2js.test

@@ -73,6 +73,9 @@
 ;; CHECK-NEXT:   --const-hoisting                              hoist repeated constants to a
 ;; CHECK-NEXT:                                                 local
 ;; CHECK-NEXT:
+;; CHECK-NEXT:   --constraint-analysis                         finds and uses mathematical
+;; CHECK-NEXT:                                                 constraints on locals
+;; CHECK-NEXT:
 ;; CHECK-NEXT:   --dae                                         removes arguments to calls in an
 ;; CHECK-NEXT:                                                 lto-like manner
 ;; CHECK-NEXT: