Add a ConstraintAnalysis pass

src/ir/constraint.cpp

@@ -126,12 +126,9 @@ void AndedConstraintSet::approximateAnd(const Constraint& c) {
 
 void AndedConstraintSet::approximateOr(const AndedConstraintSet& other) {
   // If one is empty (no constraints, everything is true, and we can prove
-  // nothing useful) then it does not add anything to the other.
-  if (empty()) {
-    *this = other;
-    return;
-  }
-  if (other.empty()) {
+  // nothing useful) then we can prove nothing after the OR.
+  if (empty() || other.empty()) {
+    clear();
     return;
   }
 
@@ -153,4 +150,111 @@ void AndedConstraintSet::approximateOr(const AndedConstraintSet& other) {
   clear();
 }
 
+std::optional<LocalConstraint> LocalConstraint::parse(Expression* curr) {
+  auto parseEqZArgument =
+    [&](Expression* value) -> std::optional<LocalConstraint> {
+    if (auto* get = value->dynCast<LocalGet>()) {
+      // Canonicalize EqZ to Eq of 0.
+      auto value = Literal::makeZero(get->type);
+      return LocalConstraint{get->index, Constraint{Abstract::Eq, {value}}};
+    }
+    // TODO: Recursively parse and reverse a constraint
+    return {};
+  };
+
+  if (auto* unary = curr->dynCast<Unary>()) {
+    if (Abstract::getUnary(unary->type, Abstract::EqZ) == unary->op) {
+      return parseEqZArgument(unary->value);
+    }
+    return {};
+  }
+
+  if (auto* refIsNull = curr->dynCast<RefIsNull>()) {
+    return parseEqZArgument(refIsNull->value);
+  }
+
+  // Parse a get or a constant.
+  auto parseTerm = [&](Expression* expr) -> std::optional<Term> {
+    if (auto* get = expr->dynCast<LocalGet>()) {
+      return Term{get->index};
+    }
+    if (Properties::isSingleConstantExpression(expr)) {
+      return Term{Properties::getLiteral(expr)};
+    }
+    return {};
+  };
+
+  auto parseBinaryArguments =
+    [&](Abstract::Op op,
+        Expression* left,
+        Expression* right) -> std::optional<LocalConstraint> {
+    // The left must be a get.
+    if (auto* get = left->dynCast<LocalGet>()) {
+      // The right can be any term.
+      if (auto value = parseTerm(right)) {
+        return LocalConstraint{get->index, Constraint{op, *value}};
+      }
+    }
+    return {};
+  };
+
+  if (auto* binary = curr->dynCast<Binary>()) {
+    // The operation must be one we recognize.
+    for (auto op : {Abstract::Eq, Abstract::Ne}) {
+      if (Abstract::getBinary(binary->type, op) == binary->op) {
+        return parseBinaryArguments(op, binary->left, binary->right);
+      }
+    }
+    return {};
+  }
+
+  if (auto* refEq = curr->dynCast<RefEq>()) {
+    return parseBinaryArguments(Abstract::Eq, refEq->left, refEq->right);
+  }
+
+  return {};
+}
+
+void LocalConstraintMap::approximateOr(const LocalConstraintMap& other) {
+  // Find things in both, and OR them.
+  for (auto& [local, constraints] : other) {
+    if (auto iter = find(local); iter != end()) {
+      iter->second.approximateOr(constraints);
+    }
+  }
+
+  // Remove things only in us.
+  std::erase_if(*this, [&](const auto& item) {
+    const auto& [local, constraints] = item;
+    return !other.contains(local);
+  });
+}
+
+std::ostream& operator<<(std::ostream& o, const Constraint& constraint) {
+  o << "Constraint{" << /*constraint.op <<*/ ", ";
+  if (auto* c = std::get_if<Literal>(&constraint.term)) {
+    o << *c;
+  } else if (auto* i = std::get_if<Index>(&constraint.term)) {
+    o << "Index(" << *i << ')';
+  }
+  o << '}';
+  return o;
+}
+
+std::ostream& operator<<(std::ostream& o,
+                         const AndedConstraintSet& constraints) {
+  o << "AndedConstraintSet{";
+  bool first = true;
+  for (auto& constraint : constraints) {
+    if (first) {
+      first = false;
+    } else {
+      o << ", ";
+    }
+    o << constraint;
+  }
+  o << '}';
+  return o;
+}
+
 } // namespace wasm::constraint

src/ir/constraint.h

@@ -121,6 +121,35 @@ struct AndedConstraintSet : inplace_vector<Constraint, MaxConstraints> {
   void approximateOr(const AndedConstraintSet& other);
 };
 
+// A local plus a constraint on it.
+struct LocalConstraint {
+  Index local;
+  Constraint constraint;
+
+  // Try to parse BinaryenIR into a local to which a constraint is applied. For
+  // example
+  //
+  //   (i32.eq (local.get $r) (i32.const 10))
+  //
+  // parses into
+  //
+  //   LocalConstraint($r, { x == 10 })
+  //
+  static std::optional<LocalConstraint> parse(Expression* curr);
+};
+
+// A map of locals and their constraints.
+struct LocalConstraintMap
+  : public std::unordered_map<Index, AndedConstraintSet> {
+  // Perform an OR as above on each local that appears in both maps. If a local
+  // appears only in one, we can infer nothing, and drop it.
+  void approximateOr(const LocalConstraintMap& other);
+};
+
+std::ostream& operator<<(std::ostream& o, const Constraint& constraint);
+std::ostream& operator<<(std::ostream& o,
+                         const AndedConstraintSet& constraints);
+
 } // namespace wasm::constraint
 
 #endif // wasm_ir_constraint_h

src/passes/CMakeLists.txt

@@ -26,6 +26,7 @@ set(passes_SOURCES
   CodeFolding.cpp
   ConstantFieldPropagation.cpp
   ConstHoisting.cpp
+  ConstraintAnalysis.cpp
   DataFlowOpts.cpp
   DeadArgumentElimination.cpp
   DeadArgumentElimination2.cpp

src/passes/ConstraintAnalysis.cpp

@@ -0,0 +1,217 @@
+/*
+ * Copyright 2026 WebAssembly Community Group participants
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//
+// Use mathematical constraint solving to optimize. For example:
+//
+//  if (x == 10) {
+//    assert(x != 0); // redundant and can be removed.
+//  }
+//
+
+#include "cfg/cfg-traversal.h"
+#include "ir/constraint.h"
+#include "ir/drop.h"
+#include "ir/literal-utils.h"
+#include "ir/local-graph.h"
+#include "ir/properties.h"
+#include "pass.h"
+#include "support/unique_deferring_queue.h"
+#include "support/utilities.h"
+#include "wasm-builder.h"
+#include "wasm.h"
+
+namespace wasm {
+
+using namespace wasm::constraint;
+
+namespace {
+
+// In each basic block we will store the relevant operations, which are all
+// local gets and sets, branches, and uses of them.
+struct Info {
+  std::vector<Expression**> actions;
+
+  // For each local index, we track the constraints we know about it. We only do
+  // so at the start of each block, which is enough for the analysis below.
+  //
+  // We use an optional here to represent the "null" state before any
+  // information arrives. (From the perspective of set theory, nullopt can be
+  // taken to mean the empty set is the set of values possible for each local.)
+  std::optional<LocalConstraintMap> startConstraints;
+};
+
+struct ConstraintAnalysis
+  : public WalkerPass<
+      CFGWalker<ConstraintAnalysis, Visitor<ConstraintAnalysis>, Info>> {
+  bool isFunctionParallel() override { return true; }
+
+  // Locals are not modified here.
+  bool requiresNonNullableLocalFixups() override { return false; }
+
+  std::unique_ptr<Pass> create() override {
+    return std::make_unique<ConstraintAnalysis>();
+  }
+
+  // Branches outside of the function can be ignored, as we only look at local
+  // state in the function.
+  bool ignoreBranchesOutsideOfFunc = true;
+
+  // Store the actions we care about.
+  void addAction() {
+    if (currBasicBlock) {
+      currBasicBlock->contents.actions.push_back(getCurrentPointer());
+    }
+  }
+
+  void visitLocalSet(LocalSet* curr) { addAction(); }
+  void visitUnary(Unary* curr) { addAction(); }
+  void visitBinary(Binary* curr) { addAction(); }
+  void visitRefEq(RefEq* curr) { addAction(); }
+  void visitRefIsNull(RefIsNull* curr) { addAction(); }
+
+  void visitFunction(Function* curr) {
+    if (!entry) {
+      // Body is unreachable, no entry block.
+      return;
+    }
+    // TODO: optimize for speed, find relevant locals etc.
+    flow();
+    optimize();
+  }
+
+  // Flow infos around until we have inferred all we can about the constraints
+  // in each location.
+  void flow() {
+    // Start from the entry. That block has incoming values - defaults - for
+    // each var.
+    auto& entryConstraints = entry->contents.startConstraints;
+    entryConstraints.emplace();
+    auto* func = getFunction();
+    auto numLocals = func->getNumLocals();
+    for (Index i = 0; i < numLocals; i++) {
+      if (!func->isVar(i)) {
+        continue;
+      }
+      auto type = func->getLocalType(i);
+      // TODO: support tuples
+      if (type.size() == 1 && LiteralUtils::canMakeZero(type)) {
+        auto value = Literal::makeZero(type);
+        (*entryConstraints)[i].approximateAnd(
+          Constraint{Abstract::Eq, {value}});
+      }
+    }
+
+    // Starting from the entry, keep going while we find something new.
+    UniqueDeferredQueue<BasicBlock*> work;
+    work.push(entry);
+    while (!work.empty()) {
+      auto* block = work.pop();
+
+      // Start at the top of the block, then go through, applying things.
+      LocalConstraintMap constraints = *block->contents.startConstraints;
+      for (auto** currp : block->contents.actions) {
+        applyToConstraints(*currp, constraints);
+      }
+
+      // We now know the values at the end of the block. Flow it onward, and
+      // where it causes changes, queue more work.
+      for (auto* out : block->out) {
+        auto& outConstraints = out->contents.startConstraints;
+        if (!outConstraints) {
+          // This is the first data arriving.
+          outConstraints.emplace(constraints);
+          work.push(out);
+          continue;
+        }
+
+        // This is later data, which may or may not cause changes.
+        auto old = outConstraints;
+        outConstraints->approximateOr(constraints);
+        if (*outConstraints != old) {
+          work.push(out);
+        }
+      }
+    }
+  }
+
+  // After inferring all we can, apply it to optimize the code.
+  void optimize() {
+    for (auto& block : basicBlocks) {
+      // Follow the general shape of flow(): we need to see what the state is
+      // at each intermediate point inside the block. (Flowing between blocks is
+      // of course not needed at this stage.)
+      auto& constraints = block->contents.startConstraints;
+      if (!constraints) {
+        // Unreachable.
+        continue;
+      }
+
+      for (auto** currp : block->contents.actions) {
+        applyToConstraints(*currp, *constraints);
+        optimizeExpression(currp, *constraints);
+      }
+    }
+  }
+
+  // Given an expression and the constraints on it, optimize it.
+  void optimizeExpression(Expression** currp,
+                          const LocalConstraintMap& constraints) {
+    auto* curr = *currp;
+    auto parsed = LocalConstraint::parse(curr);
+    if (!parsed) {
+      return;
+    }
+
+    auto iter = constraints.find(parsed->local);
+    if (iter == constraints.end()) {
+      return;
+    }
+    auto& localConstraints = iter->second;
+    Result result = localConstraints.proves(parsed->constraint);
+    if (result == Unknown) {
+      // If we parsed something using two locals, like x != y, we can also look
+      // for the flipped condition among y's constraints TODO
+      return;
+    }
+
+    // We know the result!
+    auto& wasm = *getModule();
+    auto value =
+      LiteralUtils::makeFromInt32(result == True ? 1 : 0, curr->type, wasm);
+    *currp = getDroppedChildrenAndAppend(
+      curr, wasm, getPassOptions(), value, DropMode::IgnoreParentEffects);
+  }
+
+  // Given an expression, apply it to the constraints. For example, a local.set
+  // sets the value for that local.
+  void applyToConstraints(Expression* curr, LocalConstraintMap& constraints) {
+    if (auto* set = curr->dynCast<LocalSet>()) {
+      auto& localConstraints = constraints[set->index];
+      localConstraints.clear();
+      if (Properties::isSingleConstantExpression(set->value)) {
+        auto value = Properties::getLiteral(set->value);
+        localConstraints.approximateAnd(Constraint{Abstract::Eq, {value}});
+      }
+    }
+  }
+};
+
+} // anonymous namespace
+
+Pass* createConstraintAnalysisPass() { return new ConstraintAnalysis(); }
+
+} // namespace wasm

src/passes/pass.cpp

@@ -129,6 +129,9 @@ void PassRegistry::registerPasses() {
   registerPass("cfp-reftest",
                "propagate constant struct field values, using ref.test",
                createConstantFieldPropagationRefTestPass);
+  registerPass("constraint-analysis",
+               "finds and uses mathematical constraints on locals",
+               createConstraintAnalysisPass);
   registerPass(
     "dce", "removes unreachable code", createDeadCodeEliminationPass);
   registerPass("dealign",