Can we replace IV increasing from addition to XOR in CTR mode? In CTR mode (not nonce-based), if we have ${IV}\stackrel{\$}{\leftarrow}\{0,1\}^{128}$ and want to encrypt message blocks $M_1, M_2, ..., M_\ell \in\{0,1\}^{128}$: 

The ciphertext is $IV\parallel C_1\parallel C_2\parallel...\parallel C_\ell$, where $C_i=AES_k(IV+i-1)\oplus M_i$.

Note that $IV$ is random here.



How about changing the CTR mode into the following algorithm?

The ciphertext is $IV\parallel C_1\parallel C_2\parallel...\parallel C_\ell$, where $C_i=AES_k(\boxed{IV\oplus(i-1)_{128}})\oplus M_i$.

Here, $(i-1)_{128}$ means a 128-bit block that has $(i-1)$ in its lower bits. 



Such a change has a benefit: it is easier to implement $(IV\oplus1)$ than implement $(IV+1)$ using CPU instructions or in garbled circuits.

I wonder whether there is any security proof showing such a construction is equal to CTR. Currently, I don't even find the good keyword for that.

Note: one answer How do we compute IV+1 in CTR mode? mentions this change. I feel some security discussion is needed.
A fairly common way to implement CTR mode is to construct the IV by taking a per-message nonce of, say, 96 bits and appending 32 zero bits to the right of it.  These 32 least-significant bits are then incremented by one for each cipher block in the message. 

This method has the useful property that if the nonces are never reused, and if no message contains more than 232 cipher blocks, then the counter values can be guaranteed to never repeat.

For your purposes, another useful feature of this method is that, as long as the above conditions hold (i.e. as long as $i \le 2^{32}$ and the lowest 32 bits of the IV are all zero), then $IV + (i-1) = IV \oplus (i-1)$.  Thus, it makes no difference at all whether you combine the IV and the block counter using addition or XOR, or even just concatenate the nonce directly with the 32-bit block counter.