This patch allows the inliner to inspect !callees metadata attached to an indirect call site, and then inline the subset of callees for which inlining is profitable. The inlined code is conditionally executed depending on the run-time value of the call site's function pointer. !callees metadata is attached to an indirect call by the called value propagation pass and indicates the set of functions the call site might call.
Functionally, the patch versions an indirect call site for each possible callee that can be inlined, and then promotes those call sites to direct calls. If inlining is unsuccessful for any reason, a promoted call site is demoted and made indirect once again. This ensures that no direct call sites remain after inlining that weren't already in the program. Although call site promotion based on !callees metadata could conceivably be performed as a stand-alone pass, performing it in the inliner avoids extra work, since inline cost is used as the determining measure. Moreover, knowing if a callee will be inlined is probably one of the most reasonable static estimates of whether a call site should be promoted.
A dependent revision (D39339) modifies the call graph analyses to consider !callees metadata. It ensures the inliner will visit all of the functions listed in a given !callees metadata node prior to the functions containing call sites annotated by that node. This means the inliner's normal bottom-up traversal of the call graph is valid when promoting and then inlining the subset of possible callees.