In general, the primary data is the control flow. Edge profiling or path profiling e.g. https://era.library.ualberta.ca/items/2ff4f1c2-9664-43cf-8d76-2ff8b9fd5b

In general, the primary data is the control flow. Edge profiling or path profiling e.g. https://era.library.ualberta.ca/items/2ff4f1c2-9664-43cf-8d76-2ff8b9fd5ba0/view/0b4a9f23-6cfd-4b76-bc2c-76aaae9c3da1/TR10-05.pdf https://era.library.ualberta.ca/items/2ff4f1c2-9664-43cf-8d7... For the instrumentation based profiling, there are other extra information collected, like frequent indirect branch targets (e.g. virtual calls in C++, to support speculative devirtualization which again enables inlining), specific values for certain arithmetic operations that can be sped up if you know the typical value (e.g. a particular division in the code only or mostly handles power-of-2, it can be optimized to use shift if the target cpu has particularly slow division, etc, etc), or values of certain function calls (e.g. length of memcpy) that can be optimized if you know the typical value (inline/unroll memcpy instead of doing a call), etc. Clang has what they call context-sensitive profile: https://reviews.llvm.org/D54175 https://reviews.llvm.org/D54175 which partially achieves what you're asking. Clang also supports sampling profiler - https://clang.llvm.org/docs/UsersManual.html#using-sampling-profilers https://clang.llvm.org/docs/UsersManual.html#using-sampling-... which gives you somewhat similar control flow profile.