C call specialization misses with `METH_CLASS`, `METH_STATIC` or `METH_COEXIST`

Bug report

Bug description:

The specializer ignores METH_CLASS, METH_STATIC and METH_COEXIST when selecting a specialized C-call instruction, but the corresponding flag guards compare all flags. Affected calls fail these guards and fall back to generic CALL, even after repeated specialization. Return values are correct.

Save this as repro.py and run PYTHON_JIT=0 python repro.py with CPython 3.13 or newer:

import dis
import math


def counter(f):
    call = [i for i in dis.get_instructions(f, adaptive=True)
            if i.baseopname == "CALL"][-1]
    cache = {name: data for name, _, data in call.cache_info}
    return call.opname, cache["counter"]


def control():
    math.gcd(4, 6)


def affected():
    dict.fromkeys((), None)


for f in control, affected:
    for _ in range(100):
        f()
    before = counter(f)
    for _ in range(10):
        f()
    print(f.__name__, before[0], "hit" if counter(f) == before else "miss")

Output from an unpatched Linux build of 5539c2a5437 (3.16.0a0):

control CALL_BUILTIN_FAST hit
affected CALL_BUILTIN_FAST miss

Both call sites should report hit. The example detects misses by comparing the adaptive counter before and after ten calls.

For dict.fromkeys, the specializer masks out METH_CLASS and selects CALL_BUILTIN_FAST, but its guard requires exactly METH_FASTCALL. The actual flags are METH_FASTCALL | METH_CLASS. The method-descriptor guards and corresponding Tier 2 optimizer checks have the same mismatch.

I also reproduced the issue on Linux with CPython 3.13.14, 3.14.7, 3.14.7 free-threaded and 3.15.0rc2.

More cases, pystats results, timing measurements and source analysis.

I have a patch with Tier 1 and Tier 2 regression tests and will open a PR.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-157834

Lưu ví dụ được cung cấp dưới dạng repro.py và chạy nó với PYTHON_JIT=0 trên CPython 3.13 hoặc mới hơn để tái hiện adaptive-counter misses. Đọc specialization được trích dẫn trong Python/specialize.c và các kiểm tra guard và Tier 2 trong Python/bytecodes.c. Hoàn tất khi cả hai call site đều báo hit và các regression test của Tier 1 và Tier 2 bao phủ các flags bị ảnh hưởng.