`CALL_METHOD_DESCRIPTOR_*` misses for inherited built-in methods on subclass instances

[marinelay]

Feature or enhancement

Proposal:

While looking at the guards used by the CALL_METHOD_DESCRIPTOR_* specializations, I noticed that inherited built-in methods on subclass instances can be specialized, but then fail the runtime guard.

Problem

The affected specializations appear to be:

• CALL_METHOD_DESCRIPTOR_NOARGS
• CALL_METHOD_DESCRIPTOR_O
• CALL_METHOD_DESCRIPTOR_FAST
• CALL_METHOD_DESCRIPTOR_FAST_WITH_KEYWORDS

For example:

class MyList(list):
    pass

def count_one(values):
    return values.count(1)

After warmup, the call in count_one() specializes to CALL_METHOD_DESCRIPTOR_O. However, when the specialized instruction runs with a MyList instance, its guard fails and execution leaves the fast path.

specialize_method_descriptor() selects a CALL_METHOD_DESCRIPTOR_* instructions, and it does not require the receiver to have an exact type:

list instance   → CALL_METHOD_DESCRIPTOR_O
MyList instance → CALL_METHOD_DESCRIPTOR_O

However, the runtime guard is stricter. For example, _GUARD_CALLABLE_METHOD_DESCRIPTOR_O contains:

EXIT_IF(!Py_IS_TYPE(self, method->d_common.d_type));

For an inherited list method called on MyList, method->d_common.d_type is list, so this exact type check fails.

As a result, the exact list receiver reaches the fast path, while the subclass receiver repeatedly misses the runtime guard:

list instance   → guard succeeds → _CALL_METHOD_DESCRIPTOR_O_INLINE
MyList instance → guard fails    → exit/fallback

---

There is already a related test (test_call_list_append) which expects a list subclass inheriting list.append to specialize to CALL_METHOD_DESCRIPTOR_O:

class MyList(list): pass
my_list_append(MyList())
self.assert_specialized(my_list_append, "CALL_METHOD_DESCRIPTOR_O")

This test appears to expect CALL_METHOD_DESCRIPTOR_O to handle the subclass case. However, the current exact type guard rejects the subclass receiver every time. As a result, CALL_METHOD_DESCRIPTOR_O may be installed, but its method-descriptor fast path can never be reached for this case.

Suggested fix

I suggest allowing the runtime guards to accept subclass instances as well:

- EXIT_IF(!Py_IS_TYPE(self, method->d_common.d_type));
+ EXIT_IF(!PyObject_TypeCheck(self, method->d_common.d_type));

But, I'm not sure whether relaxing these guards would affect any assumptions elsewhere in the interpreter.

If not, I would be happy to prepare a PR updating the four guards and adding regression tests that verify the fast path is actually executed.

Versions

CPython 3.16.0a0, Ubuntu 24.04, gcc 13.3.0

Has this already been discussed elsewhere?

No response given

Links to previous discussion of this feature:

No response

[picnixz]

cc @Fidget-Spinner