Intel is not especially forthcoming on details of its branch predictor. Quoting Agner Fog's The microarchitecture of Intel, AMD and VIA CPUs (2013-09-04 edition): "The branch predictor appears to have been redesigned in the Haswell, but very little is known about its construction."
It is most likely that either a global history string (e.g., one bit indicating taken/not-taken for the last N branches) or possibly a path history (similar to a global history string but typically using a hashing of instruction addresses) is used to address one or more branch prediction tables, likely with the instruction address. This is probably something vaguely similar to but more sophisticated than a gshare predictor. (One might consider this history as part of the branch predictor rather than as an input.)
The instruction address is also likely used to index a branch target buffer (likely with another table for indirect calls and jumps which would likely use some global history information). The instruction address is also likely to be used to predict that nature of any branches (branch identification), so that appropriate target predictors are used. Branch identification is particularly important for cases using a specialized predictor (such as function return targets).
For any misprediction of branch type, target, or branch direction, the correct information derived later in the pipeline is communicated to the predictor. (It may be helpful to also confirm correct predictions.) For ordinary branches and jumps, the target can be calculated in the front-end (before branch condition evaluation) to correct target mispredictions for taken cases. Similarly, branch misidentification can be fixed after instruction decode. On a misprediction of branch direction or target for indirect control flow the correct information can be provided from later in the pipeline.
