Easiest way to collect dynamic Instruction execution counts?


I’d like a simple and fast way to collect the number of times each Instruction was executed in a given run of the application. As far as I can tell, there are a number of approaches I can take:

  • Use PIN. This would require using DWARF debug info and Instruction debug info to attempt to map instructions in the binary to instructions in the bitcode; not 100% sure how accurate this will be.

  • Use llvm-prof. Two questions here. First, I’ve seen on Stack Overflow an option to opt called --insert-edge-profiling. However, that option doesn’t seem to be available in 3.6? Second, it appears that such profiling only records execution counts at the Function level, not at the individual Instruction level. Is that correct?

  • Write a new tool similar to AddressSanitizer. This may work, but seems like overkill.

Is there an easier way to achieve my goal that I’m missing?


That seems like a job for valgrind?

Assuming you’re on a supported platform, but these days that includes all the common Mac/Linux/Android platforms except ARM64.


Can valgrind give me the execution counts for each Instruction in the LLVM bitcode?


Dear Stephen,

Kevin, one of my students, wrote an LLVM pass and run-time library that records and reports the number of dynamic LLVM instructions executed by a program. You can find the code at https://github.com/hxy9243/priv_analysis. The pass you want is in DynCount.cpp, and the code works with LLVM mainline.

One thing that this pass does is to alter the dynamic counts slightly to account for additional branches that our other transformation adds before analysis but will remove before code generation, so you may need to adjust the code slightly.


John Criswell

Machine instructions, yes. You didn’t say bitcode instruction.

Though it amounts to the same thing, as all instructions in the same basic block have the same execution count and the basic blocks should correspond.


Thanks for the pointer; I’ll indeed take a look at your student’s pass and supporting runtime library.


Yes, I apologize, I meant bitcode instructions. But you’re right, as long as there exists a mapping between the basic blocks in the assembly and the basic blocks in the LLVM bitcode, then I should be able to use any tool that gives me assembly instruction execution counts (such as Valgrind or PIN) to find out bitcode instruction execution counts. I’m thinking I could use DWARF debug info to create such a mapping.