C call specialization misses with `METH_CLASS`, `METH_STATIC` or `METH_COEXIST`

Bug report

Bug description:

The specializer ignores METH_CLASS, METH_STATIC and METH_COEXIST when selecting a specialized C-call instruction, but the corresponding flag guards compare all flags. Affected calls fail these guards and fall back to generic CALL, even after repeated specialization. Return values are correct.

Save this as repro.py and run PYTHON_JIT=0 python repro.py with CPython 3.13 or newer:

import dis
import math


def counter(f):
    call = [i for i in dis.get_instructions(f, adaptive=True)
            if i.baseopname == "CALL"][-1]
    cache = {name: data for name, _, data in call.cache_info}
    return call.opname, cache["counter"]


def control():
    math.gcd(4, 6)


def affected():
    dict.fromkeys((), None)


for f in control, affected:
    for _ in range(100):
        f()
    before = counter(f)
    for _ in range(10):
        f()
    print(f.__name__, before[0], "hit" if counter(f) == before else "miss")

Output from an unpatched Linux build of 5539c2a5437 (3.16.0a0):

control CALL_BUILTIN_FAST hit
affected CALL_BUILTIN_FAST miss

Both call sites should report hit. The example detects misses by comparing the adaptive counter before and after ten calls.

For dict.fromkeys, the specializer masks out METH_CLASS and selects CALL_BUILTIN_FAST, but its guard requires exactly METH_FASTCALL. The actual flags are METH_FASTCALL | METH_CLASS. The method-descriptor guards and corresponding Tier 2 optimizer checks have the same mismatch.

I also reproduced the issue on Linux with CPython 3.13.14, 3.14.7, 3.14.7 free-threaded and 3.15.0rc2.

More cases, pystats results, timing measurements and source analysis.

I have a patch with Tier 1 and Tier 2 regression tests and will open a PR.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-157834

Enregistrez l’exemple fourni sous le nom repro.py et exécutez-le avec PYTHON_JIT=0 sur CPython 3.13 ou une version ultérieure afin de reproduire les adaptive-counter misses. Lisez la spécialisation citée dans Python/specialize.c ainsi que les vérifications du guard et de Tier 2 dans Python/bytecodes.c. La tâche est terminée lorsque les deux call sites signalent hit et que les tests de régression de Tier 1 et Tier 2 couvrent les flags concernés.