C call specialization misses with `METH_CLASS`, `METH_STATIC` or `METH_COEXIST`

Bug report

Bug description:

The specializer ignores METH_CLASS, METH_STATIC and METH_COEXIST when selecting a specialized C-call instruction, but the corresponding flag guards compare all flags. Affected calls fail these guards and fall back to generic CALL, even after repeated specialization. Return values are correct.

Save this as repro.py and run PYTHON_JIT=0 python repro.py with CPython 3.13 or newer:

import dis
import math


def counter(f):
    call = [i for i in dis.get_instructions(f, adaptive=True)
            if i.baseopname == "CALL"][-1]
    cache = {name: data for name, _, data in call.cache_info}
    return call.opname, cache["counter"]


def control():
    math.gcd(4, 6)


def affected():
    dict.fromkeys((), None)


for f in control, affected:
    for _ in range(100):
        f()
    before = counter(f)
    for _ in range(10):
        f()
    print(f.__name__, before[0], "hit" if counter(f) == before else "miss")

Output from an unpatched Linux build of 5539c2a5437 (3.16.0a0):

control CALL_BUILTIN_FAST hit
affected CALL_BUILTIN_FAST miss

Both call sites should report hit. The example detects misses by comparing the adaptive counter before and after ten calls.

For dict.fromkeys, the specializer masks out METH_CLASS and selects CALL_BUILTIN_FAST, but its guard requires exactly METH_FASTCALL. The actual flags are METH_FASTCALL | METH_CLASS. The method-descriptor guards and corresponding Tier 2 optimizer checks have the same mismatch.

I also reproduced the issue on Linux with CPython 3.13.14, 3.14.7, 3.14.7 free-threaded and 3.15.0rc2.

More cases, pystats results, timing measurements and source analysis.

I have a patch with Tier 1 and Tier 2 regression tests and will open a PR.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-157834

Save the supplied example as repro.py and run it with PYTHON_JIT=0 on CPython 3.13 or newer to reproduce the adaptive-counter misses. Read the cited specialization in Python/specialize.c and the guard and Tier 2 checks in Python/bytecodes.c. Done means both call sites report hit and Tier 1 and Tier 2 regression tests cover the affected flags.