C call specialization misses with `METH_CLASS`, `METH_STATIC` or `METH_COEXIST`

Bug report

Bug description:

The specializer ignores METH_CLASS, METH_STATIC and METH_COEXIST when selecting a specialized C-call instruction, but the corresponding flag guards compare all flags. Affected calls fail these guards and fall back to generic CALL, even after repeated specialization. Return values are correct.

Save this as repro.py and run PYTHON_JIT=0 python repro.py with CPython 3.13 or newer:

import dis
import math


def counter(f):
    call = [i for i in dis.get_instructions(f, adaptive=True)
            if i.baseopname == "CALL"][-1]
    cache = {name: data for name, _, data in call.cache_info}
    return call.opname, cache["counter"]


def control():
    math.gcd(4, 6)


def affected():
    dict.fromkeys((), None)


for f in control, affected:
    for _ in range(100):
        f()
    before = counter(f)
    for _ in range(10):
        f()
    print(f.__name__, before[0], "hit" if counter(f) == before else "miss")

Output from an unpatched Linux build of 5539c2a5437 (3.16.0a0):

control CALL_BUILTIN_FAST hit
affected CALL_BUILTIN_FAST miss

Both call sites should report hit. The example detects misses by comparing the adaptive counter before and after ten calls.

For dict.fromkeys, the specializer masks out METH_CLASS and selects CALL_BUILTIN_FAST, but its guard requires exactly METH_FASTCALL. The actual flags are METH_FASTCALL | METH_CLASS. The method-descriptor guards and corresponding Tier 2 optimizer checks have the same mismatch.

I also reproduced the issue on Linux with CPython 3.13.14, 3.14.7, 3.14.7 free-threaded and 3.15.0rc2.

More cases, pystats results, timing measurements and source analysis.

I have a patch with Tier 1 and Tier 2 regression tests and will open a PR.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-157834

将提供的示例保存为 repro.py，并在 CPython 3.13 或更高版本上使用 PYTHON_JIT=0 运行，以复现 adaptive-counter misses。阅读 Python/specialize.c 中引用的 specialization，以及 Python/bytecodes.c 中的 guard 和 Tier 2 检查。完成标准是两个 call site 都报告 hit，并且 Tier 1 和 Tier 2 regression tests 覆盖受影响的 flags。