[PGO] Promote indirect calls to conditional direct calls with value-profile

[xur]

Summary

This patch implements the transformation that promotes indirect calls to conditional direct calls when the indirect-call value profile meta-data is available.

It is invoked in two places: (1) after the IR-level profile-use pass. (2) in LTO optimizations. (1) performs limited promotion as many of the targets are in other modules. (2) is capable of promoting all the targets.

The Transformation performs legality check and profitability check. Legality check mainly for corrupted profiles where the ic-targets can points to wrong targets. Profitability check currently only uses the counts value and the ratio b/w this target and total indirect-call count.

We stress-tested the transformation with SPEC2006 to promote all the indirect-targets in the value profiles (in lto compilation).

We haven yet to do a thorough performance tuning. Here is the initial performance numbers with some SPEC programming running (10-run average on an ibis_sandybridge machine).

`` (1) (2) (3) (4)
spec/2006/fp/C++/453.povray 42.05 -8.17% +3.72% +2.32%
spec/2006/int/C++/471.omnetpp 23.69 -3.41% +3.37% +1.27%
spec/2006/int/C++/473.astar 23.04 -1.49% +1.91% +1.68%
spec/2006/int/C++/483.xalancbmk 38.83 -1.91% +6.01% +4.99%
spec/2000/int/C++/252.eon 4999 -14.47% +4.84% +2.36%``

(1) PGO + LTO
(2) PGO
(3) PGO + LTO + ICP(Indirect Call Promotion)
(4) PGO + LTO + ICP(only promote 1 target)

One known issue to be fixed later:
code duplication (like unroll) b/w value profile annotation and value profile transformation blindly duplicates the counts in the VP metadata. Need to update the metadata copying.

[silvas]

Can you split the pass out of PGOInstrumentation.cpp?

Also, there does not appear to be enough testing for the amount of functionality introduced.

include/llvm/Transforms/Instrumentation.h

86

Please name the parameter after what it does. What does it control?

Also, whatever it does control can probably be done in a separate patch.

lib/ProfileData/InstrProf.cpp

91

This function is confusingly named. How about "get name ignoring per-file mangling" or something? A comment can explain why this is valid for LTO.

lib/Transforms/Instrumentation/PGOInstrumentation.cpp

302

Please clarify why this is needed in a comment (and possibly a separate patch).

973

No floating point.

1000

ParamNum

1025

NumVals is way too generic of a name. Please be more specific. If it is just the number of entries in ValueData then use ArrayRef.

1059

NumPromotions is always just equal to WorkList.size().

Actually, I would remove the terminology "worklist" and just say "promotions".

E.g. add struct CandidatePromotion with two members TargetFunction and Count. Then have this function just return a std::vector<CandidatePromotion>.

1130

Redundant parentheses.

1140

std::next (or llvm::next, if we can't use std::next yet).

I.e.

if (FuncRetType != CallRetType)
  NewInst = new BitCastInst(NewInst, CallRetType, "", std::next(NewInst));

Also, I see you are using IRBuilder above. Any reason why IRBuilder is not preferred for the IR building later in the function?

1184

The naming here is quite poor. We have 3 functions:

performPromotion
doPromotion
doVersion

I think a better naming is:

processFunction
tryToPromote
promote

respectively.

1188

In a separate patch, please add a helper function findIndirectCallSites(F) so that you can do for auto &I : findIndirectCallSites(F)) instead of having this boilerplate manually calling visit.

1198

getCandidatePromotionsForCallSite is a better name.

auto CandidatePromotions = getCandidatePromotionsForCallSite(...);
NumPromoted += tryToPromote(ICall, CandidatePromotions, TotalCount)

1213

If you had ValueDataArray in an ArrayRef (and annotateValueSite took an ArrayRef), then this would be annotateValueSite(*M, *I, ValueDataArray.drop_front(NumPromoted, TotalCount, IPVK_IndirectCallTarget, MaxNumPromotions) which would be a lot nicer.

test/Transforms/PGOProfile/indirect_call_annotation.ll

2

Do not piggy-back on existing tests. You are adding completely new functionality which should have its own independent tests.

[xur]

Sean: Thanks for the detailed suggestions. I'll split the new feature into a separated file.

I will also put some of changes into a separated patch.

I do have some other tests locally -- I just not yet to convert them into the unit tests. I'll add them alone with the review goes.

lib/ProfileData/InstrProf.cpp

91

This is to deal with the interaction with LTO's internalization. I'll split this part of change into a separated patch.

lib/Transforms/Instrumentation/PGOInstrumentation.cpp

302

This will go to a separated patch.

1025

will use a ArrayRef

1140

No particular reason that I don't use IRbuilder. The inserted instructions are not in different BBs (not with the original call inst). I just thought it's convenient to change the code stream directly.

1188

ok. will do a separated patch.

1213

yes. this is cleaner. but this requires a annotateValueSite() change. I prefer to do this in a post-commit cleanup patch.

test/Transforms/PGOProfile/indirect_call_annotation.ll

2

undo the change.

[silvas]

lib/Transforms/Instrumentation/PGOInstrumentation.cpp

1213

A pre-commit cleanup patch is also possible.

[mehdi_amini]

include/llvm/ProfileData/InstrProf.h

160

I expect lengthy description of the naming, why the difference between LTO and non-LTO. If it described somewhere else, please insert a reference to it.

lib/Transforms/Instrumentation/PGOInstrumentation.cpp

126

Remove

1140

The IRBuilder has the nice property that you can supply a name for the instruction and it'll show up only in debug build.

[xur]

split some of the chages to http://reviews.llvm.org/D17895

include/llvm/ProfileData/InstrProf.h

160

see http://reviews.llvm.org/D17895

[xur]

Integrated with Sean's review comments.
more unit tests are still to be added. Will include them later.

This patch depends on
http://reviews.llvm.org/D17895

Thanks,

-Rong

[davidxl]

lib/Transforms/Instrumentation/PGOInstrumentation.cpp

1223

See comment in 17895.

There is no need for this map. InstrProfSymtab should return the real function name from the PGOName's MD5 sum (icall target value). Using the real function name, you can directly use:

M.getFunction(RealName) to return the function.

[mehdi_amini]

lib/Transforms/Instrumentation/PGOInstrumentation.cpp

1140

Just a note: forget the comment above on the IRBuilder, this has changed recently and names are handled dynamically in the Context now.

[xur]

This patch uses the updated InstrProf interface in patch http://reviews.llvm.org/D17895.

A few more unit tests also added.

This also fixed a regression in last patch: it seems the "std::next()" is not working I thought here:
NewInst = new BitCastInst(NewInst, CallRetType, "", std::next(NewInst));
It would not return the next instruction. This is fixed in this patch.

Again, this patch depends on http://reviews.llvm.org/D17895.

[xur]

Update the patch with recently refactoring patches.
Add handling of invoke instructions (covariant return type for invoke is to be supported later).
Also add some internal options for debugging.
Stressed tested with SPEC2006.

[johanengelen]

lib/Transforms/IPO/PassManagerBuilder.cpp

222

Placing add(createPGOIndirectCallPromotionPass()) here means that IndirectCallPromotionPass will be enabled at -O0, which I think is undesirable.

[mehdi_amini]

I expect that somewhere you look at the "opt_none" attribute on the function and bail.

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

558 ↗

(On Diff #52762)

Why isn't is a function pass?

[mehdi_amini]

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

74 ↗

(On Diff #52762)

s/transforamtion/transformation/

[xur]

I will check Attribute::OptimizeNone per @joker.eph's suggestion.

lib/Transforms/IPO/PassManagerBuilder.cpp

222

Good point. We should not do this in O0. I'll move this call out of this function.

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

558 ↗

(On Diff #52762)

mainly I need to create InstrProfSymtab which is module level. I don't want to create this symtab for each function.

[xur]

Integrated the review comments from Johan and Mehdi.

Thanks!

[mehdi_amini]

lib/Transforms/IPO/PassManagerBuilder.cpp

376

Why is it running twice in LTO mode?

578

What is the meaning of the "xur" here?

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

534 ↗

(On Diff #52833)

Can you implement this in a utility function? I expect the "pass wrapper" to have a dummy runOnModule that would only call the public API.

[xur]

Medhi, here is the patch that uses a static function. Does it look OK?

As for your question about the two-step promotion: Yes, this produces the same result if we only do the promotion in LTO optimization. The intra-module promotion will stop at the first target that it cannot promote and write the remaining VP targets to the metadata. The cross-module promotion will pick it up and do the rest.

Thanks!
-Rong

[mehdi_amini]

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

535 ↗

(On Diff #52852)

Nice, but should be static considering the name. Alternatively I don't mind having it non static if it is called something like promoteIndirectCalls()

[xur]

Fix the function name.

[johanengelen]

(thanks for your work on this btw! ;)

test/Transforms/PGOProfile/icp_vararg.ll

33 ↗

(On Diff #52833)

I think the branch_weights are calculated slightly wrong.
branch_weights usually have an offset of 1, where 1 means there is no profile measurement that it was taken. See the documentation of scaleBranchWeight in CodeGenPGO.cpp of Clang.

[xur]

We intentionally drop this +1 in IR level PGO instrumentation. I thing
branch weight can handle 0 weight now.

Thanks,

-Rong

[xur]

Refactor the code to break a large function into smaller ones.
This new patch supports the covariant return for invoke instructions too.

[xur]

fix comments.

[anemet]

I benchmarked this patch on our ARM64. I've done two runs.

In the first, I used the patch with -enable-value-profiling, LTO and PGO of course. I was using FE-based instrumentation. This is the first column in the table below.

I've also done a second run where I tried to fix up the missed promotions due to the incorrect internalization for static functions (the FE variant of D17895). This helps povray which has a few critical indirect calls to functions that are statically defined. Unfortunately, the promoted calls are still not inlined in povray which would further improve performance.

This the second column in the table and the diff is relative to the previous column (i.e. povray in the second run recovers *half* the regression from the first run). The numbers are directly from LNT so a negative percentage is a performance *improvement*.

|                        |    patch  | no-localize |
|------------------------+-----------+-------------+
| CINT2006/464.h264ref   |    -3.35% |             |
| CINT2006/483.xalancbmk |    -1.11% |             |
|------------------------+-----------+-------------+
| CFP2006/453.povray     |    +0.92% | -0.48%      |
|------------------------+-----------+-------------+
| CINT2000/252.eon       |    -1.06% |             |

[anemet]

So to summarize, this looks great on ARM64 assuming we have a solution for the internalization problem for FE-based profiling as well. xur, is there already a patch for that?

[xur]

Adam, thanks for testing on ARM64 and sharing the number.

For front-end's VP annotation, I've sent out a patch for review a few weeks
early:
http://reviews.llvm.org/D18624

Could you try that?

Thanks,

-Rong

[anemet]

Sure, I'll try it.

[davidxl]

First batch of comments from browsing the patch.

lib/IR/Instructions.cpp

3016

This change can be carved out as a NFC refactoring.

lib/Transforms/IPO/PassManagerBuilder.cpp

578

that left -- that are left

579

intra-module targets

580

can you explain the 'save compile time' part here?

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

74 ↗

(On Diff #53081)

once the total number of promotions equals the cutoff value.

77 ↗

(On Diff #53081)

Why all upper case, ICPCutOff looks better.

80 ↗

(On Diff #53081)

-->

If ICPCSSkip is non zero, the first ICPCSSkip callsites will be skipped.

92 ↗

(On Diff #53081)

If the option is set to true, only call instructions will be considered for transformation -- invoke instructions will be ignored.

149 ↗

(On Diff #53081)

maps indirect call profile values to function names.

169 ↗

(On Diff #53081)

records

170 ↗

(On Diff #53081)

Perhaps PromotionCandidate?

185 ↗

(On Diff #53081)

Document this method -- what is passed in and what is returned.

189 ↗

(On Diff #53081)

make it static member function

221 ↗

(On Diff #53081)

just
if (count < ICPCountThreshold)

223 ↗

(On Diff #53081)

When can this happen? Should it be corrected in caller?

234 ↗

(On Diff #53081)

Is this check needed? NotAvailableInModule is essentially body not available.

278 ↗

(On Diff #53081)

This local variable is not used.

362 ↗

(On Diff #53081)

make the name more meaningful such as "if.true.direct_targ"

537 ↗

(On Diff #53081)

It always returns true -- change it to void

[anemet]

In D17864#402676, @xur wrote:

Adam, thanks for testing on ARM64 and sharing the number.

For front-end's VP annotation, I've sent out a patch for review a few weeks
early:
http://reviews.llvm.org/D18624

Could you try that?

I am replying under D18624.

[davidxl]

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

378 ↗

(On Diff #53081)

Do you need merge BB here for invoke at all (which will be empty and unreachable)?

439 ↗

(On Diff #53081)

if you remove MergeBB, there is no need for this step -- or this is needed to avoid fixing up phis in the original normal dest?

445 ↗

(On Diff #53081)

add comment -- clear the value profile data.

555 ↗

(On Diff #53081)

Can this be folded into create4DirectCallInst call?

[xur]

lib/IR/Instructions.cpp

3016

OK. Will split this code out to a separated patch.

lib/Transforms/IPO/PassManagerBuilder.cpp

580

As I mentioned in earlier reply. the optimization performed in LTOOptimizationPasses cannot be palatalized. The Intra-module promotion can be trivially paralleled. LTO part of promotion takes pretty long for moderately large programs like 483.xalancbmk in spec2006. Splitting into two part saves the time for parallel builds.

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

185 ↗

(On Diff #53081)

will do.

223 ↗

(On Diff #53081)

will have this checked in the caller.

234 ↗

(On Diff #53081)

decls might be available.
just for debug.
I'll merge this two cases.

378 ↗

(On Diff #53081)

I assume you are referring this to the invoke instr.
I need this BB to insert a potential bit-cast inst.
If there is not bit-cast, it will be just a branch to the original destBB.
I assume this gonna be clean by late CFG optimization.

439 ↗

(On Diff #53081)

as I mentioned early, this is for bit-cast, not for phis.

555 ↗

(On Diff #53081)

I remember there is a transformation ordering issue. but I can try. will comment this more in the new patch.

[xur]

Integrated David's comments.
(1) it turned out we don't need new interface for castIsValid. I now use the existing isBitCastable()
(2) I was able to fold insertCallRetCast() to createDirectCallInst() which make code more compact.
I have to add a reference parameter in createDirCallInst() as I need to use both the direct-call instruction and the bitcast instruction.

Thanks,

-Rong

[davidxl]

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

408 ↗

(On Diff #54784)

Fix the comments.

This method fixes up PHI nodes in block BB. In BB, there may be PHIs with incoming block being OrigBB (the MergeBB after block splitting). After if-then-else splitting, OrigBB is no longer the predecessor block of BB. Instead two new predecessors are added: IndirectCallBB and DirectCallBB, so the PHI nodes's incoming BBs need to be fixed up accordingly.

412 ↗

(On Diff #54784)

This method is correct only for unwind/eh dest BB for an invoke instruction. It is not right for the normalDest.

For normalDest BB, the PHI node's predecessor BB remain unchanged -- OrigBB (i.e. MergeBB), but the value of the PHI incoming value may change into new PHI or cast inst inserted into the MergeBB.

428 ↗

(On Diff #54784)

Add assert that V is defined in a BB that dominates IndirectCallBB

478 ↗

(On Diff #54784)

Clean --> Clear

497 ↗

(On Diff #54784)

This comment needs lots of cleanup.

502 ↗

(On Diff #54784)

Since this function body computes lots of values already available in the caller context, suggest removing it and inline it into the caller.

511 ↗

(On Diff #54784)

nullptr ? It does not look correct. It shold be the DirectcallInst.

513 ↗

(On Diff #54784)

see comment in fixupPHINode method.

526 ↗

(On Diff #54784)

For Invoke, since the cast is inserted in the original BB (mergeBB) -- i.e., the new NormalDest, it post-dominates the call return values from both predecessors so there seems to be no need for phi insertion -- unless you split the another new BB between DirectBB and MergeBB.

[xur]

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

412 ↗

(On Diff #54784)

Note the condition "if (DirectCallBB)"
I only change the phi operand points to DirectcallBB when it's not a nullptr.

For normalDest, the DirectcallBB is set to nullptr in the caller.
This also answers your question about the call's nullptr argument.

511 ↗

(On Diff #54784)

see the reply in fixupPHINode.

513 ↗

(On Diff #54784)

see the reply in the fixupPHINode.

526 ↗

(On Diff #54784)

The phi is not inserted in the mergeBB. It's in the BB the joins mergeBB and original NormalDest. We now have one return value from the original indirect invoke and one from new direct invoke. A phi is needed in the join point.

[xur]

another comments

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

428 ↗

(On Diff #54784)

do you mean V is defined in IndirectCallBB and dominates BB?

we are in the middle of CFG transformation and dominate tree might not be valid.
Is there a cheap way to check?

why do you think we need to check this? this seems to be obvious (unless the phis are corrupted already).

[xur]

Addressed some of the David's most recently comments:
(1) comments change
(2) inline fixupInvokeInst into promote(). After this change, we no longer need the direct-call instruction. So I changed createDirectCallInst() to return the new instruction (either is direct-call or the result-cast).
(3) simplify the test case for the covariant return for call.
(4) add a test case for covariant return for invoke.

[davidxl]

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

387 ↗

(On Diff #54915)

Document that this is needed for the newly created direct call (invoke) -- as its normal Dst will be fixed up to MergeBB

408 ↗

(On Diff #54915)

.. in BB (where BB can either be the original NormalDst BB or the unwind BB of the indirect call/invoke instruction).

410 ↗

(On Diff #54915)

After if-then-else splitting, if BB is the unwindBB, OrigBB will no longer be the pre...

If BB is the Original NormalDstBB, a new incoming edge will be added to the original NormalDstBB from the IndirectCallBB.

413 ↗

(On Diff #54915)

I suggest split this method into two fixPHINodesForNormDest and fixPHINodesForUnwind -- for better readability.

458 ↗

(On Diff #54915)

Document parameters. For instance, for mergeBB, document that it is the mergeBB (bottom BB of the if-then-else-diamond) after indirect call promotion. For Invoke instruction, the edges from directBB and IndirectBB to mergedBB are removed before this call (during createIfThenElse).

Also document the CFG effect of this method: after the call, the direct invokes normal destination will be redirected to MergeBB.

462 ↗

(On Diff #54915)

NormalDest --> MergeBB

473 ↗

(On Diff #54915)

Add a comment lie:

direct Invoke's normal destinaion is fixed up to mergeBB. MergeBB is the place where return cast is inserted. Also since indirectCallBB does not have an edge to MergeBB, there is no need to insert new PHIs into MergeBB.

[xur]

Integrated David's most recently review comments.

Thanks,

-Rong

[davidxl]

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

415 ↗

(On Diff #55106)

Document 'Inst'. Also looks like Inst is not used in the body.

424 ↗

(On Diff #55106)

Is this condition possible?

428 ↗

(On Diff #55106)

What is the phi arg value for this new incoming block?

433 ↗

(On Diff #55106)

invoke --> invoke (indirect)

436 ↗

(On Diff #55106)

Add this description: the OrigBB is still an incoming block for NormalDstBB, but the phi incoming value from this block becomes the new value NewInst

447 ↗

(On Diff #55106)

Is IX == -1 possible?

[xur]

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

415 ↗

(On Diff #55106)

you are right. Inst parameter is only used to check the invoke return value. I assume the UnwindDest will not have a phi using the return value.

I'll remove Inst from the parameter list.

424 ↗

(On Diff #55106)

why not? The operand can come from a basic block other than OrigBB:
like bb1 (def v_1) --> bb2(invoke) --> bb

bb2(def v_2) --> bb

bb can have a phi(v_1, v_2) in bb.
The incoming block for the phi with ix 0 is bb1, rather bb2, right?

428 ↗

(On Diff #55106)

it's the same value as the one from OriginBB: in the two statements, the first only dup the value, and second one rest the incoming bb to DirectCallBB.

447 ↗

(On Diff #55106)

see earlier reply.

[davidxl]

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

424 ↗

(On Diff #55106)

Sorry -- I misread it :) WHat I meant is that the loop should have an assert that OrigBB is found in one of the iterations

428 ↗

(On Diff #55106)

IF the value was the value from the original indirect call, should the new value become the result of the direct call?

[xur]

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

424 ↗

(On Diff #55106)

It might not have a PHI that have OrigBB has the incoming BB, right?

428 ↗

(On Diff #55106)

We have the special handling of the return value PHI. This only applies to the NormalDest.

I assume UnwindBB won't use the return value. Let me know my assumption is incorrect.

This code handle the phi other than the return value PHI.

[davidxl]

LGTM

lib/Transforms/Instrumentation/IndirectCallPromotion.cpp

428 ↗

(On Diff #55106)

This assumption is probably correct -- in case of exception, the return value is not properly defined.

include/llvm/IR/InstrTypes.h

public:
   /// @brief Return the destination type, as a convenience
   Type* getDestTy() const { return getType(); }
 
   /// This method can be used to determine if a cast from S to DstTy using
   /// Opcode op is valid or not.
   /// @returns true iff the proposed cast is valid.
   /// @brief Determine if a cast is valid without creating one.
   static bool castIsValid(Instruction::CastOps op, Value *S, Type *DstTy);
+  /// Same as the above method, but test if type SrcTy can be casted to DestTy.
+  static bool castIsValid(Instruction::CastOps op, Type *SrcTy, Type *DstTy);
 
   /// @brief Methods for support type inquiry through isa, cast, and dyn_cast:
   static inline bool classof(const Instruction *I) {
     return I->isCast();
   }
   static inline bool classof(const Value *V) {
     return isa<Instruction>(V) && classof(cast<Instruction>(V));
   }

include/llvm/InitializePasses.h

 void initializeDominatorTreeWrapperPassPass(PassRegistry&);
 void initializeEarlyIfConverterPass(PassRegistry&);
 void initializeEdgeBundlesPass(PassRegistry&);
 void initializeExpandPostRAPass(PassRegistry&);
 void initializeAAResultsWrapperPassPass(PassRegistry &);
 void initializeGCOVProfilerPass(PassRegistry&);
 void initializePGOInstrumentationGenPass(PassRegistry&);
 void initializePGOInstrumentationUsePass(PassRegistry&);
+void initializePGOIndirectCallPromotionPass(PassRegistry&);
 void initializeInstrProfilingPass(PassRegistry&);
 void initializeAddressSanitizerPass(PassRegistry&);
 void initializeAddressSanitizerModulePass(PassRegistry&);
 void initializeMemorySanitizerPass(PassRegistry&);
 void initializeThreadSanitizerPass(PassRegistry&);
 void initializeSanitizerCoverageModulePass(PassRegistry&);
 void initializeDataFlowSanitizerPass(PassRegistry&);
 void initializeScalarizerPass(PassRegistry&);

include/llvm/LinkAllPasses.h

ForcePassLinking() {
       (void) llvm::createDivergenceAnalysisPass();
       (void) llvm::createDomOnlyPrinterPass();
       (void) llvm::createDomPrinterPass();
       (void) llvm::createDomOnlyViewerPass();
       (void) llvm::createDomViewerPass();
       (void) llvm::createGCOVProfilerPass();
       (void) llvm::createPGOInstrumentationGenPass();
       (void) llvm::createPGOInstrumentationUsePass();
+      (void) llvm::createPGOIndirectCallPromotionPass();
       (void) llvm::createInstrProfilingPass();
       (void) llvm::createFunctionImportPass();
       (void) llvm::createFunctionInliningPass();
       (void) llvm::createAlwaysInlinerPass();
       (void) llvm::createGlobalDCEPass();
       (void) llvm::createGlobalOptimizerPass();
       (void) llvm::createGlobalsAAWrapperPass();
       (void) llvm::createIPConstantPropagationPass();

include/llvm/ProfileData/InstrProf.h

inline StringRef getInstrProfFileOverriderFuncName() {
   return "__llvm_profile_override_default_filename";
 }
 
 /// Return the modified name for function \c F suitable to be
 /// used the key for profile lookup.
 std::string getPGOFuncName(const Function &F,
                            uint64_t Version = INSTR_PROF_INDEX_VERSION);
 
+/// Return the modified name for function \c F suitable to be
+/// used the key for profile lookup in LTO compilation.
+std::string getPGOFuncNameLTO(const Function &F);
+
 /// Return the modified name for a function suitable to be
 /// used the key for profile lookup. The function's original
 /// name is \c RawFuncName and has linkage of type \c Linkage.
 /// The function is defined in module \c FileName.
 std::string getPGOFuncName(StringRef RawFuncName,
                            GlobalValue::LinkageTypes Linkage,
                            StringRef FileName,
                            uint64_t Version = INSTR_PROF_INDEX_VERSION);
public:
   inline std::error_code create(StringRef D, uint64_t BaseAddr);
   /// \c NameStrings is a string composed of one of more sub-strings
   ///  encoded in the format described in \c collectPGOFuncNameStrings.
   /// This method is a wrapper to \c readPGOFuncNameStrings method.
   inline std::error_code create(StringRef NameStrings);
   /// A wrapper interface to populate the PGO symtab with functions
   /// decls from module \c M. This interface is used by transformation
   /// passes such as indirect function call promotion.
-  void create(const Module &M);
+  void create(const Module &M, bool InLTO = false);
   /// Create InstrProfSymtab from a set of names iteratable from
   /// \p IterRange. This interface is used by IndexedProfReader.
   template <typename NameIterRange> void create(const NameIterRange &IterRange);
   // If the symtab is created by a series of calls to \c addFuncName, \c
   // finalizeSymtab needs to be called before looking up function names.
   // This is required because the underlying map is a vector (for space
   // efficiency) which needs to be sorted.
   inline void finalizeSymtab();

include/llvm/Transforms/Instrumentation.h

 };
 ModulePass *createGCOVProfilerPass(const GCOVOptions &Options =
                                    GCOVOptions::getDefault());
 
 // PGO Instrumention
 ModulePass *createPGOInstrumentationGenPass();
 ModulePass *
 createPGOInstrumentationUsePass(StringRef Filename = StringRef(""));
+ModulePass *createPGOIndirectCallPromotionPass(bool InLTO = false);
 
 /// Options for the frontend instrumentation based profiling pass.
 struct InstrProfOptions {
   InstrProfOptions() : NoRedZone(false) {}
 
   // Add the 'noredzone' attribute to added runtime library calls.
   bool NoRedZone;
 

lib/IR/Instructions.cpp

 /// could be broken out into the separate constructors but it is useful to have
 /// it in one place and to eliminate the redundant code for getting the sizes
 /// of the types involved.
 bool 
 CastInst::castIsValid(Instruction::CastOps op, Value *S, Type *DstTy) {
 
   // Check for type sanity on the arguments
   Type *SrcTy = S->getType();
+  return castIsValid(op, SrcTy, DstTy);
+}
+
+bool 
+CastInst::castIsValid(Instruction::CastOps op, Type *SrcTy, Type *DstTy) {
 
   if (!SrcTy->isFirstClassType() || !DstTy->isFirstClassType() ||
       SrcTy->isAggregateType() || DstTy->isAggregateType())
     return false;
 
   // Get the size of the types in bits, we'll need this later
   unsigned SrcBitSize = SrcTy->getScalarSizeInBits();
   unsigned DstBitSize = DstTy->getScalarSizeInBits();

lib/ProfileData/InstrProf.cpp

std::string getPGOFuncName(StringRef RawFuncName,
   return Function::getGlobalIdentifier(RawFuncName, Linkage, FileName);
 }
 
 std::string getPGOFuncName(const Function &F, uint64_t Version) {
   return getPGOFuncName(F.getName(), F.getLinkage(), F.getParent()->getName(),
                         Version);
 }
 
+std::string getPGOFuncNameLTO(const Function &F) {
+  // First check if these is a metadata.
+  MDNode *MD = F.getMetadata("PGOFuncName");
+  if (MD != nullptr) {
+    StringRef S = cast<MDString>(MD->getOperand(0))->getString();
+    return S.str();
+  }
+  // Strip out prefix from the the internalized symbols.
+  std::string PGOName = getPGOFuncName(F);
+  size_t S = PGOName.find_first_of(':');
+  if (S == std::string::npos)
+    return PGOName;
+  return PGOName.substr(S + 1);
+}
+
 StringRef getFuncNameWithoutPrefix(StringRef PGOFuncName, StringRef FileName) {
   if (FileName.empty())
     return PGOFuncName;
   // Drop the file name including ':'. See also getPGOFuncName.
   if (PGOFuncName.startswith(FileName))
     PGOFuncName = PGOFuncName.drop_front(FileName.size() + 1);
   return PGOFuncName;
 }
GlobalVariable *createPGOFuncNameVar(Module &M,
 
   return FuncNameVar;
 }
 
 GlobalVariable *createPGOFuncNameVar(Function &F, StringRef FuncName) {
   return createPGOFuncNameVar(*F.getParent(), F.getLinkage(), FuncName);
 }
 
-void InstrProfSymtab::create(const Module &M) {
-  for (const Function &F : M)
+void InstrProfSymtab::create(const Module &M, bool InLTO) {
+  for (const Function &F : M) {
+    if (!F.hasName())
+      continue;
+    if (InLTO)
+      addFuncName(getPGOFuncNameLTO(F));
+    else
       addFuncName(getPGOFuncName(F));
+  }
 
   finalizeSymtab();
 }
 
 int collectPGOFuncNameStrings(const std::vector<std::string> &NameStrs,
                               bool doCompression, std::string &Result) {
   uint8_t Header[16], *P = Header;
   std::string UncompressedNameStrings =

lib/Transforms/IPO/PassManagerBuilder.cpp

if (!PGOInstrGen.empty()) {
     MPM.add(createPGOInstrumentationGenPass());
     // Add the profile lowering pass.
     InstrProfOptions Options;
     Options.InstrProfileOutput = PGOInstrGen;
     MPM.add(createInstrProfilingPass(Options));
   }
   if (!PGOInstrUse.empty())
     MPM.add(createPGOInstrumentationUsePass(PGOInstrUse));
+
+  // Indirect call promotion.
+  MPM.add(createPGOIndirectCallPromotionPass());
 }
 void PassManagerBuilder::addFunctionSimplificationPasses(
     legacy::PassManagerBase &MPM) {
   // Start of function pass.
   // Break up aggregate allocas, using SSAUpdater.
   if (UseNewSROA)
     MPM.add(createSROAPass());
   else
void PassManagerBuilder::populateModulePassManager(
   }
 
   if (!PerformThinLTO)
     /// PGO instrumentation is added during the compile phase for ThinLTO, do
     /// not run it a second time
     addPGOInstrPasses(MPM);
 
   if (EnableNonLTOGlobalsModRef)
     // We add a module alias analysis pass here. In part due to bugs in the
     // analysis infrastructure this "works" in that the analysis stays alive
     // for the entire SCC pass run below.
     MPM.add(createGlobalsAAWrapperPass());
 
   // Start of CallGraph SCC passes.
   if (!DisableUnitAtATime)
     MPM.add(createPruneEHPass()); // Remove dead EH info
   if (Inliner) {
if (FunctionIndex)
     PM.add(createFunctionImportPass(FunctionIndex));
 
   // Allow forcing function attributes as a debugging and tuning aid.
   PM.add(createForceFunctionAttrsLegacyPass());
 
   // Infer attributes about declarations if possible.
   PM.add(createInferFunctionAttrsLegacyPass());
 
+  // Indirect call promotion. (xur)
+  PM.add(createPGOIndirectCallPromotionPass(true));
+
   // Propagate constants at call sites into the functions they call.  This
   // opens opportunities for globalopt (and inlining) by substituting function
   // pointers passed as arguments to direct uses of functions.
   PM.add(createIPSCCPPass());
 
   // Now that we internalized some globals, see if we can hack on them!
   PM.add(createPostOrderFunctionAttrsLegacyPass());
   PM.add(createReversePostOrderFunctionAttrsPass());

lib/Transforms/Instrumentation/Instrumentation.cpp

 /// library.
 void llvm::initializeInstrumentation(PassRegistry &Registry) {
   initializeAddressSanitizerPass(Registry);
   initializeAddressSanitizerModulePass(Registry);
   initializeBoundsCheckingPass(Registry);
   initializeGCOVProfilerPass(Registry);
   initializePGOInstrumentationGenPass(Registry);
   initializePGOInstrumentationUsePass(Registry);
+  initializePGOIndirectCallPromotionPass(Registry);
   initializeInstrProfilingPass(Registry);
   initializeMemorySanitizerPass(Registry);
   initializeThreadSanitizerPass(Registry);
   initializeSanitizerCoverageModulePass(Registry);
   initializeDataFlowSanitizerPass(Registry);
 }
 
 /// LLVMInitializeInstrumentation - C binding for
 /// initializeInstrumentation.
 void LLVMInitializeInstrumentation(LLVMPassRegistryRef R) {
   initializeInstrumentation(*unwrap(R));
 }

lib/Transforms/Instrumentation/PGOInstrumentation.cpp

 STATISTIC(NumOfPGOInstrument, "Number of edges instrumented.");
 STATISTIC(NumOfPGOEdge, "Number of edges.");
 STATISTIC(NumOfPGOBB, "Number of basic-blocks.");
 STATISTIC(NumOfPGOSplit, "Number of critical edge splits.");
 STATISTIC(NumOfPGOFunc, "Number of functions having valid profile counts.");
 STATISTIC(NumOfPGOMismatch, "Number of functions having mismatch profile.");
 STATISTIC(NumOfPGOMissing, "Number of functions without profile.");
 STATISTIC(NumOfPGOICall, "Number of indirect call value instrumentations.");
+STATISTIC(NumOfPGOICallPromotion, "Number of indirect call promotions.");
 
 // Command line option to specify the file to read profile from. This is
 // mainly used for testing.
 static cl::opt<std::string>
     PGOTestProfileFile("pgo-test-profile-file", cl::init(""), cl::Hidden,
                        cl::value_desc("filename"),
                        cl::desc("Specify the path of profile data file. This is"
                                 "mainly for test purpose."));
 
 // Command line options to disable value profiling. The default is false:
 // i.e. value profiling is enabled by default. This is for debug purpose.
 static cl::opt<bool> DisableValueProfiling("disable-vp", cl::init(false),
                                            cl::Hidden,
                                            cl::desc("Disable Value Profiling"));
-
+static cl::opt<unsigned>
+    ICPCountThreshold("icp-count-threshold", cl::Hidden, cl::ZeroOrMore,
+                      cl::init(1000),
+                      cl::desc("The minimum count to the direct call target "
+                               "for the promotion"));
+
+static cl::opt<float>
+    ICPPercentThreshold("icp-percent-threshold", cl::init(33), cl::Hidden,
+                        cl::ZeroOrMore,
+                        cl::desc("The percentage threshold for the promotion"));
+
+static cl::opt<unsigned>
+    MaxNumPromotions("icp-max-prom", cl::init(2), cl::Hidden, cl::ZeroOrMore,
+                     cl::desc("Max number of promotions for a single indirect "
+                              "call callsite"));
+
+static cl::opt<bool> ICPLTOMode("icp-lto", cl::init(false), cl::Hidden,
+                                cl::desc("Run indirect-call promotion in LTO "
+                                         "mode"));
 namespace {
+
 class PGOInstrumentationGen : public ModulePass {
 public:
   static char ID;
 
   PGOInstrumentationGen() : ModulePass(ID) {
     initializePGOInstrumentationGenPass(*PassRegistry::getPassRegistry());
   }
 
private:
   std::string ProfileFileName;
   std::unique_ptr<IndexedInstrProfReader> PGOReader;
   bool runOnModule(Module &M) override;
 
   void getAnalysisUsage(AnalysisUsage &AU) const override {
     AU.addRequired<BlockFrequencyInfoWrapperPass>();
   }
 };
+
+class PGOIndirectCallPromotion : public ModulePass {
+public:
+  static char ID;
+
+  PGOIndirectCallPromotion(bool InLTO = false) : ModulePass(ID), InLTO(InLTO) {
+    // Commandline option has the priority for InLTO.
+    InLTO |= ICPLTOMode;
+
+    initializePGOIndirectCallPromotionPass(*PassRegistry::getPassRegistry());
+  }
+
+  const char *getPassName() const override {
+    return "PGOIndirectCallPromotion";
+  }
+
+private:
+  bool runOnModule(Module &M) override;
+
+  // If this pass is called in LTO. We need to special handling the PGOFuncName
+  // for the static variables due to LTO's internalization.
+  bool InLTO;
+};
 } // end anonymous namespace
 
 char PGOInstrumentationGen::ID = 0;
 INITIALIZE_PASS_BEGIN(PGOInstrumentationGen, "pgo-instr-gen",
                       "PGO instrumentation.", false, false)
 INITIALIZE_PASS_DEPENDENCY(BlockFrequencyInfoWrapperPass)
 INITIALIZE_PASS_DEPENDENCY(BranchProbabilityInfoWrapperPass)
 INITIALIZE_PASS_END(PGOInstrumentationGen, "pgo-instr-gen",

 INITIALIZE_PASS_DEPENDENCY(BranchProbabilityInfoWrapperPass)
 INITIALIZE_PASS_END(PGOInstrumentationUse, "pgo-instr-use",
                     "Read PGO instrumentation profile.", false, false)
 
 ModulePass *llvm::createPGOInstrumentationUsePass(StringRef Filename) {
   return new PGOInstrumentationUse(Filename.str());
 }
 
+char PGOIndirectCallPromotion::ID = 0;
+INITIALIZE_PASS(PGOIndirectCallPromotion, "pgo-icall-prom",
+                "Use PGO instrumentation profile to promote indirect calls to "
+                "direct calls.",
+                false, false)
+
+ModulePass *llvm::createPGOIndirectCallPromotionPass(bool InLTO) {
+  return new PGOIndirectCallPromotion(InLTO);
+}
+
 namespace {
 /// \brief An MST based instrumentation for PGO
 ///
 /// Implements a Minimum Spanning Tree (MST) based instrumentation for PGO
 /// in the function level.
 struct PGOEdge {
   // This class implements the CFG edges. Note the CFG can be a multi-graph.
   // So there might be multiple edges with same SrcBB and DestBB.
MST.dumpEdges(dbgs(), Twine("Dump Function ") + FuncName + " Hash: " +
                               Twine(FunctionHash) + "\t" + Str);
   }
 
   FuncPGOInstrumentation(Function &Func, bool CreateGlobalVar = false,
                          BranchProbabilityInfo *BPI = nullptr,
                          BlockFrequencyInfo *BFI = nullptr)
       : F(Func), FunctionHash(0), MST(F, BPI, BFI) {
     FuncName = getPGOFuncName(F);
+    if (FuncName != Func.getName()) {
+      LLVMContext &C = F.getContext();
+      MDNode *N = MDNode::get(C, MDString::get(C, FuncName.c_str()));
+      F.setMetadata("PGOFuncName", N);
+    }
     computeCFGHash();
     DEBUG(dumpInfo("after CFGMST"));
 
     NumOfPGOBB += MST.BBInfos.size();
     for (auto &E : MST.AllEdges) {
       if (E->Removed)
         continue;
       NumOfPGOEdge++;
if (NumValueSites != ICV.IndirectCallInsts.size()) {
     return;
   }
 
   for (auto &I : ICV.IndirectCallInsts) {
     DEBUG(dbgs() << "Read one indirect call instrumentation: Index="
                  << IndirectCallSiteIndex << " out of " << NumValueSites
                  << "\n");
     annotateValueSite(*M, *I, ProfileRecord, IPVK_IndirectCallTarget,
-                      IndirectCallSiteIndex);
+                      IndirectCallSiteIndex, MaxNumPromotions);
     IndirectCallSiteIndex++;
   }
 }
 } // end anonymous namespace
 
 // Create a COMDAT variable IR_LEVEL_PROF_VARNAME to make the runtime
 // aware this is an ir_level profile so it can set the version flag.
 static void createIRLevelProfileFlagVariable(Module &M) {
BranchProbabilityInfo *BPI =
         &(getAnalysis<BranchProbabilityInfoWrapperPass>(F).getBPI());
     BlockFrequencyInfo *BFI =
         &(getAnalysis<BlockFrequencyInfoWrapperPass>(F).getBFI());
     PGOUseFunc Func(F, &M, BPI, BFI);
     setPGOCountOnFunc(Func, PGOReader.get());
   }
   return true;
 }
+
+// The class for main data structure to promote indirect calls to conditional
+// direct calls.
+class ICallPromotionFunc {
+private:
+  Function &F;
+  Module *M;
+
+  // Symtab that maps value to instrumented function name.
+  InstrProfSymtab *Symtab;
+
+  // PGO function name to Function map.
+  const StringMap<Function *> *ProfNameMap;
+
+  // Allocate space to read the profile annotation.
+  std::unique_ptr<InstrProfValueData[]> ValueDataArray;
+
+  bool isPromotionProfitable(uint64_t Count, uint64_t TotalCount);
+
+  enum TargetStatus {
+    OK,                   // Should be able to promote.
+    NotAvailableInModule, // Cannot find the target in current module.
+    NotFoundinNameMap,    // Cannot find the function defines.
+    ReturnTypeMismatch,   // Return type mismatch b/w target and indirectcall.
+    NumArgsMismatch,      // Number of arguments does not match.
+    ArgTypeMismatch       // Type mismatch in the arguments (cannot bitcast).
+  };
+
+  TargetStatus isPromotionLegal(CallInst *Inst, uint64_t Target, Function *&F);
+
+  typedef std::vector<std::pair<Function *, uint64_t>> ICPWorkList;
+
+  // Check if the indirectcall call site should be promoted. Return the number
+  // of promotions.
+  uint32_t analyzeCandidates(CallInst *Inst, InstrProfValueData ValueData[],
+                             uint32_t NumVals, uint64_t TotalCount,
+                             ICPWorkList &W);
+
+  bool doVersion(CallInst *Inst, Function *F, uint64_t Count,
+                 uint64_t TotalCount);
+
+  uint32_t doPromotion(CallInst *Inst, const ICPWorkList &W,
+                       uint64_t &TotalCount);
+
+  const char *StatusToString(const TargetStatus S) {
+    switch (S) {
+    case OK:
+      return "OK to promote";
+    case NotAvailableInModule:
+      return "Cannot find the target";
+    case NotFoundinNameMap:
+      return "Cannot find the target define";
+    case ReturnTypeMismatch:
+      return "Return type mismatch";
+    case NumArgsMismatch:
+      return "The number of arguments mismatch";
+    case ArgTypeMismatch:
+      return "Argument Type mismatch";
+    }
+    llvm_unreachable("Should not reach here");
+  }
+
+  // Noncopyable
+  ICallPromotionFunc(const ICallPromotionFunc &other) = delete;
+  ICallPromotionFunc &operator=(const ICallPromotionFunc &other) = delete;
+
+public:
+  ICallPromotionFunc(Function &Func, Module *Modu, InstrProfSymtab *Symtab,
+                     const StringMap<Function *> *ProfNameMap)
+      : F(Func), M(Modu), Symtab(Symtab), ProfNameMap(ProfNameMap) {
+    ValueDataArray = llvm::make_unique<InstrProfValueData[]>(MaxNumPromotions);
+  }
+  bool performPromotion();
+};
+
+bool ICallPromotionFunc::isPromotionProfitable(uint64_t Count,
+                                               uint64_t TotalCount) {
+  if (TotalCount < ICPCountThreshold || Count < ICPCountThreshold)
+    return false;
+  if (TotalCount < Count)
+    Count = TotalCount;
+  if ((double)Count / TotalCount * 100 < ICPPercentThreshold)
+    return false;
+  return true;
+}
+
+ICallPromotionFunc::TargetStatus
+ICallPromotionFunc::isPromotionLegal(CallInst *Inst, uint64_t Target,
+                                     Function *&TargetFunction) {
+  StringRef TargetFuncName = Symtab->getFuncName(Target);
+  if (TargetFuncName.empty())
+    return NotAvailableInModule;
+  auto ProfNameI = ProfNameMap->find(TargetFuncName);
+  if (ProfNameI == ProfNameMap->end())
+    return NotFoundinNameMap;
+
+  Function *DirectCallee = ProfNameI->getValue();
+  // Check the return type.
+  Type *CallRetType = Inst->getType();
+  if (!CallRetType->isVoidTy()) {
+    Type *FuncRetType = DirectCallee->getReturnType();
+    if (FuncRetType != CallRetType &&
+        !CastInst::castIsValid(Instruction::BitCast, FuncRetType, CallRetType))
+      return ReturnTypeMismatch;
+  }
+
+  // Check if the arguments are compatible with the parameters
+  FunctionType *DirectCalleeType = DirectCallee->getFunctionType();
+  unsigned ParaNum = DirectCalleeType->getFunctionNumParams();
+  CallSite CS(Inst);
+  unsigned ArgNum = CS.arg_size();
+
+  if (ParaNum != ArgNum && !DirectCalleeType->isVarArg())
+    return NumArgsMismatch;
+
+  for (unsigned I = 0; I < ParaNum; ++I) {
+    Type *PTy = DirectCalleeType->getFunctionParamType(I);
+    Type *ATy = CS.getArgument(I)->getType();
+    if (PTy == ATy)
+      continue;
+    if (!CastInst::castIsValid(Instruction::BitCast, CS.getArgument(I), PTy))
+      return ArgTypeMismatch;
+  }
+
+  DEBUG(dbgs() << " Promote the icall to " << TargetFuncName << "\n");
+  TargetFunction = DirectCallee;
+  return OK;
+}
+
+// Indirect-call promotion heursitic. The direct targets are sorted based on
+// the count. Stop at the first target that is not promoted.
+uint32_t ICallPromotionFunc::analyzeCandidates(CallInst *Inst,
+                                               InstrProfValueData ValueData[],
+                                               uint32_t NumVals,
+                                               uint64_t TotalCount,
+                                               ICPWorkList &WorkList) {
+  uint32_t NumPromotions = 0;
+
+  DEBUG(dbgs() << " \nWork on " << *Inst << " Num_targets: " << NumVals
+               << "\n");
+  for (uint32_t I = 0; I < MaxNumPromotions && I < NumVals; I++) {
+    uint64_t Count = ValueData[I].Count;
+    uint64_t Target = ValueData[I].Value;
+    DEBUG(dbgs() << " Candidate " << I << " Count=" << Count
+                 << "  Target_func: " << Target << "\n");
+
+    if (!isPromotionProfitable(Count, TotalCount)) {
+      DEBUG(dbgs() << " Not promote: Cold target.\n");
+      break;
+    }
+    Function *TargetFunction = nullptr;
+    TargetStatus Status = isPromotionLegal(Inst, Target, TargetFunction);
+    if (Status != OK) {
+      StringRef TargetFuncName = Symtab->getFuncName(Target);
+      const char *Reason = StatusToString(Status);
+      DEBUG(dbgs() << " Not promote: " << Reason << "\n");
+      Twine Msg =
+          Twine("Cannot promote indirect call to ") +
+          (TargetFuncName.empty() ? Twine(Target) : Twine(TargetFuncName)) +
+          Twine(" with count of ") + Twine(Count) + ": " + Reason;
+      emitOptimizationRemarkMissed(F.getContext(), "PGOIndirectCallPromotion",
+                                   F, Inst->getDebugLoc(), Msg);
+      break;
+    }
+    WorkList.push_back(std::make_pair(TargetFunction, Count));
+    assert(Count <= TotalCount);
+    TotalCount -= Count;
+    ++NumPromotions;
+  }
+  return NumPromotions;
+}
+
+// This furnction does the actual indireciton call promotion transformation:
+// For an icall like:
+//     Ret = (*Foo)(Args);
+// It transforms to:
+//     if (Foo == DirectCallee)
+//        Ret1 = DirectCallee(Args);
+//     else
+//        Ret2 = (*Foo)(Args);
+//     Ret = phi(Ret1, Ret2);
+// It adds type casts for the args do not match the parameters and the return
+// value. Branch weights meta data also updated.
+//
+bool ICallPromotionFunc::doVersion(CallInst *Inst, Function *DirectCallee,
+                                   uint64_t Count, uint64_t TotalCount) {
+  BasicBlock *BB = Inst->getParent();
+  DEBUG(dbgs() << "\n\n== Basic Block Before ==\n");
+  DEBUG(dbgs() << *BB << "\n");
+
+  assert(DirectCallee != nullptr);
+  CallSite CS(Inst);
+  Value *OrigCallee = CS.getCalledValue();
+
+  IRBuilder<> BBBuilder(Inst);
+  LLVMContext &Ctx = Inst->getContext();
+  Value *BCI1 =
+      BBBuilder.CreateBitCast(OrigCallee, Type::getInt8PtrTy(Ctx), "");
+  Value *BCI2 =
+      BBBuilder.CreateBitCast(DirectCallee, Type::getInt8PtrTy(Ctx), "");
+  Value *PtrCmp = BBBuilder.CreateICmpEQ(BCI1, BCI2, "");
+
+  TerminatorInst *ThenTerm, *ElseTerm;
+  uint64_t ElseCount = TotalCount - Count;
+  uint64_t MaxCount = (Count >= ElseCount ? Count : ElseCount);
+  uint64_t Scale = calculateCountScale(MaxCount);
+  MDBuilder MDB(M->getContext());
+  MDNode *BranchWeights = MDB.createBranchWeights(
+      scaleBranchCount(Count, Scale), scaleBranchCount(ElseCount, Scale));
+  SplitBlockAndInsertIfThenElse(PtrCmp, Inst, &ThenTerm, &ElseTerm,
+                                BranchWeights);
+
+  BasicBlock *DirectCallBB = ThenTerm->getParent();
+  DirectCallBB->setName("if.true");
+  Instruction *NewInst = Inst->clone();
+  ((CallInst *)NewInst)->setCalledFunction(DirectCallee);
+  ((CallInst *)NewInst)->mutateFunctionType(DirectCallee->getFunctionType());
+  NewInst->setMetadata(LLVMContext::MD_prof, 0);
+  CallSite NewCS(NewInst);
+  DirectCallBB->getInstList().insert(DirectCallBB->getFirstInsertionPt(),
+                                     NewInst);
+  FunctionType *DirectCalleeType = DirectCallee->getFunctionType();
+  unsigned ParaNum = DirectCalleeType->getFunctionNumParams();
+  for (unsigned I = 0; I < ParaNum; ++I) {
+    Type *ATy = NewCS.getArgument(I)->getType();
+    Type *PTy = DirectCalleeType->getParamType(I);
+    if (ATy != PTy) {
+      BitCastInst *BI = new BitCastInst(NewCS.getArgument(I), PTy, "", NewInst);
+      NewCS.setArgument(I, BI);
+    }
+  }
+
+  BasicBlock *MergeBB = Inst->getParent();
+  MergeBB->setName("if.end");
+  BasicBlock *IndirectCallBB = ElseTerm->getParent();
+  IndirectCallBB->setName("if.false");
+
+  // Create a phi to unify the return values of calls
+  if (!(Inst->getType()->isVoidTy())) {
+    PHINode *CallRetPhi = PHINode::Create(Inst->getType(), 0);
+    MergeBB->getInstList().push_front(CallRetPhi);
+    Inst->replaceAllUsesWith(CallRetPhi);
+
+    // Handle the case where the return types differ.
+    Type *CallRetType = Inst->getType();
+    Type *FuncRetType = DirectCallee->getReturnType();
+    if (FuncRetType != CallRetType) {
+      BasicBlock::iterator It(NewInst);
+      Instruction *NextInst = &*(++It);
+      NewInst = new BitCastInst(NewInst, CallRetType, "", NextInst);
+    }
+    CallRetPhi->addIncoming(NewInst, DirectCallBB);
+    CallRetPhi->addIncoming(Inst, IndirectCallBB);
+  }
+
+  Inst->removeFromParent();
+  IndirectCallBB->getInstList().insert(IndirectCallBB->getFirstInsertionPt(),
+                                       Inst);
+  DEBUG(dbgs() << "\n== Basic Blocks After ==\n");
+  DEBUG(dbgs() << *BB << *DirectCallBB << *IndirectCallBB << *MergeBB << "\n");
+
+  Twine Msg =
+      Twine("Promote indirect call to " + DirectCallee->getName() +
+            " with count " + Twine(Count) + " out of " + Twine(TotalCount));
+  emitOptimizationRemark(F.getContext(), "PGOIndirectCallPromotion", F,
+                         Inst->getDebugLoc(), Msg);
+  return true;
+}
+
+// Promote indirectcall to conditional direct-call for one callsite.
+uint32_t ICallPromotionFunc::doPromotion(CallInst *Inst,
+                                         const ICPWorkList &WorkList,
+                                         uint64_t &TotalCount) {
+  uint32_t Num = WorkList.size();
+  if (Num == 0)
+    return 0;
+  uint32_t NumPromoted = 0;
+  for (uint32_t I = 0; I < Num; I++) {
+    uint64_t Count = WorkList[I].second;
+    if (!doVersion(Inst, WorkList[I].first, Count, TotalCount))
+      break;
+    assert(TotalCount >= Count);
+    TotalCount -= Count;
+    NumPromoted++;
+  }
+
+  NumOfPGOICallPromotion += NumPromoted;
+  return NumPromoted;
+}
+
+// Traverse all the indirect-call callsite and get the value profile
+// annotation to perform indirect-call promotion.
+bool ICallPromotionFunc::performPromotion() {
+  PGOIndirectCallSiteVisitor ICV;
+  ICV.visit(F);
+  bool Changed = false;
+  for (auto &I : ICV.IndirectCallInsts) {
+    uint32_t NumVals;
+    uint64_t TotalCount;
+    bool Res =
+        getValueProfDataFromInst(*I, IPVK_IndirectCallTarget, MaxNumPromotions,
+                                 ValueDataArray.get(), NumVals, TotalCount);
+    if (!Res)
+      continue;
+    ICPWorkList WorkList;
+    uint32_t NumPromoted = 0;
+    if (analyzeCandidates(I, ValueDataArray.get(), NumVals, TotalCount,
+                          WorkList) > 0)
+      NumPromoted = doPromotion(I, WorkList, TotalCount);
+
+    if (NumPromoted == 0)
+      continue;
+
+    Changed = true;
+    // Adjust the MD.prof metadata. First delete the old one.
+    I->setMetadata(LLVMContext::MD_prof, 0);
+    // If all promoted, we don't need the MD.prof metadat.
+    if (TotalCount == 0 || NumPromoted == NumVals)
+      continue;
+    // Otherwise we need update with the un-promoted records back.
+    annotateValueSite(*M, *I, &(ValueDataArray.get()[NumPromoted]),
+                      NumVals - NumPromoted, TotalCount,
+                      IPVK_IndirectCallTarget, MaxNumPromotions);
+  }
+  return Changed;
+}
+
+bool PGOIndirectCallPromotion::runOnModule(Module &M) {
+  if (DisableValueProfiling)
+    return false;
+
+  StringMap<Function *> ProfNameMap;
+  // Build a profile-function-name to function map.
+  for (auto &F : M) {
+    if (F.isDeclaration())
+      continue;
+    if (!F.hasName())
+      continue;
+    if (InLTO)
+      ProfNameMap[getPGOFuncNameLTO(F)] = &F;
+    else
+      ProfNameMap[getPGOFuncName(F)] = &F;
+  }
+
+  InstrProfSymtab Symtab;
+  Symtab.create(M, InLTO);
+  bool Changed = false;
+  for (auto &F : M) {
+    if (F.isDeclaration())
+      continue;
+    ICallPromotionFunc ICallPromotion(F, &M, &Symtab, &ProfNameMap);
+    Changed |= ICallPromotion.performPromotion();
+  }
+
+  return Changed;
+}

test/Transforms/PGOProfile/indirect_call_annotation.ll

 ; RUN: llvm-profdata merge %S/Inputs/indirect_call.proftext -o %t.profdata
-; RUN: opt < %s -pgo-instr-use -pgo-test-profile-file=%t.profdata -S | FileCheck %s --check-prefix=VP-ANNOTATION
+; RUN: opt < %s -pgo-instr-use -icp-max-prom=3 -pgo-test-profile-file=%t.profdata -S | FileCheck %s --check-prefix=VP-ANNOTATION
 target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 @foo = common global i32 (i32)* null, align 8
 
 define i32 @func1(i32 %x) {
 entry:
   ret i32 %x

test/Transforms/PGOProfile/indirect_call_promotion.ll

+; RUN: opt < %s -pgo-icall-prom -S | FileCheck %s --check-prefix=ICALL-PROM
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+@foo = common global i32 ()* null, align 8
+
+define i32 @func1() {
+entry:
+  ret i32 0
+}
+
+define i32 @func2() {
+entry:
+  ret i32 1
+}
+
+define i32 @func3() {
+entry:
+  ret i32 2
+}
+
+define i32 @func4() {
+entry:
+  ret i32 3
+}
+
+define i32 @bar() {
+entry:
+  %tmp = load i32 ()*, i32 ()** @foo, align 8
+; ICALL-PROM:   [[BITCAST:%[0-9]+]] = bitcast i32 ()* %tmp to i8*
+; ICALL-PROM:   [[CMP:%[0-9]+]] = icmp eq i8* [[BITCAST]], bitcast (i32 ()* @func4 to i8*)
+; ICALL-PROM:   br i1 [[CMP]], label %if.true, label %if.false, !prof [[BRANCH_WEIGHT:![0-9]+]]
+; ICALL-PROM: if.true:
+; ICALL-PROM:   [[DIRCALL_RET:%[0-9]+]] = call i32 @func4()
+; ICALL-PROM:   br label %if.end
+  %call = call i32 %tmp(), !prof !1
+; ICALL-PROM: if.false:
+; ICALL-PROM:   %call = call i32 %tmp(), !prof [[NEW_VP_METADATA:![0-9]+]]
+  ret i32 %call
+; ICALL-PROM: if.end:
+; ICALL-PROM:   [[PHI_RET:%[0-9]+]] = phi i32 [ [[DIRCALL_RET]], %if.true ], [ %call, %if.false ]
+; ICALL-PROM:   ret i32 [[PHI_RET]]
+}
+
+!1 = !{!"VP", i32 0, i64 1600, i64 7651369219802541373, i64 1030, i64 -4377547752858689819, i64 410, i64 -6929281286627296573, i64 150, i64 -2545542355363006406, i64 10}
+
+; ICALL-PROM: [[BRANCH_WEIGHT]] = !{!"branch_weights", i32 1030, i32 570}
+; ICALL-PROM: [[NEW_VP_METADATA]] = !{!"VP", i32 0, i64 570, i64 -4377547752858689819, i64 410}