gh-155151: Check the recursion limit in CALL_EX_PY and CALL_KW_BOUND_METHOD

The generic CALL_FUNCTION_EX and CALL_KW opcodes reach start_frame, which
calls _Py_EnterRecursivePy() and raises RecursionError before the callee
runs. Their specialized forms end in _PUSH_FRAME, which decrements
py_recursion_remaining without checking it, so once a call site had been
warmed up the callee was entered and returned normally where the
unspecialized instruction raised. Warming a call site should not change
whether the target function executes.

CALL_KW_PY and CALL_BOUND_METHOD_EXACT_ARGS already guard their frame push
with _CHECK_RECURSION_REMAINING; add it to these two as well. It deopts, so
it goes where a deopt is already safe: after the existing flush in
CALL_KW_BOUND_METHOD, following the pattern of
CALL_BOUND_METHOD_EXACT_ARGS, and after _CHECK_IS_PY_CALLABLE_EX in
CALL_EX_PY, which already exits at that point.

Author: tekinertekin

Include/internal/pycore_opcode_metadata.h

@@ -6,7 +6,7 @@
 import types
 import unittest
 from test.support import (threading_helper, check_impl_detail,
-                          requires_specialization,
+                          infinite_recursion, requires_specialization,
                           cpython_only, requires_jit_disabled, reset_code)
 from test.support.import_helper import import_module
 
@@ -568,6 +568,86 @@ def test(default=None):
         with self.assertRaises(RecursionError):
             test()
 
+    # gh-155151: a specialized call opcode must not enter the callee where the
+    # generic one raises RecursionError. Warming a call site must not change
+    # whether the target runs. The probes below drive the recursion limit and
+    # then make the specialized call from the deepest live frame; the target
+    # bumps the counter with plain bytecode, so reaching it cannot itself be
+    # stopped by a second recursion check.
+
+    @requires_jit_disabled
+    @requires_specialization
+    def test_recursion_check_for_call_ex_py(self):
+        hits = 0
+        deepest_frame_claimed = False
+
+        def target(*args):
+            nonlocal hits
+            hits += 1
+            return 42
+
+        def probe(at_limit):
+            nonlocal deepest_frame_claimed
+            while not at_limit:
+                try:
+                    return probe(False)
+                except RecursionError:
+                    # Only the deepest live frame makes the call. Outer frames
+                    # re-raise, so the count is not taken after a frame has
+                    # unwound and freed recursion budget.
+                    if deepest_frame_claimed:
+                        raise
+                    deepest_frame_claimed = True
+                    at_limit = True
+            args = ()
+            return target(*args)
+
+        for _ in range(_testinternalcapi.SPECIALIZATION_THRESHOLD):
+            probe(True)
+        self.assert_specialized(probe, "CALL_EX_PY")
+
+        hits_before = hits
+        with infinite_recursion(50):
+            with self.assertRaises(RecursionError):
+                probe(False)
+        self.assertEqual(hits, hits_before)
+
+    @requires_jit_disabled
+    @requires_specialization
+    def test_recursion_check_for_call_kw_bound_method(self):
+        hits = 0
+        deepest_frame_claimed = False
+
+        class Receiver:
+            def target(self, *, value):
+                nonlocal hits
+                hits += 1
+                return value
+
+        bound_target = Receiver().target
+
+        def probe(at_limit):
+            nonlocal deepest_frame_claimed
+            while not at_limit:
+                try:
+                    return probe(False)
+                except RecursionError:
+                    if deepest_frame_claimed:
+                        raise
+                    deepest_frame_claimed = True
+                    at_limit = True
+            return bound_target(value=43)
+
+        for _ in range(_testinternalcapi.SPECIALIZATION_THRESHOLD):
+            probe(True)
+        self.assert_specialized(probe, "CALL_KW_BOUND_METHOD")
+
+        hits_before = hits
+        with infinite_recursion(50):
+            with self.assertRaises(RecursionError):
+                probe(False)
+        self.assertEqual(hits, hits_before)
+
     def test_dont_specialize_custom_vectorcall(self):
         def f():
             raise Exception("no way")

Lib/test/test_opcache.py

@@ -0,0 +1,5 @@
+Fix the specialized ``CALL_EX_PY`` and ``CALL_KW_BOUND_METHOD`` instructions
+entering the callee at the recursion limit, where the generic
+``CALL_FUNCTION_EX`` and ``CALL_KW`` raise :exc:`RecursionError`.  Both now
+check the remaining recursion depth before pushing the new frame, so warming
+a call site no longer changes whether the target is executed.

Misc/NEWS.d/next/Core_and_Builtins/2026-08-06-14-40-18.gh-issue-155151.Wq8mN3.rst

@@ -5537,6 +5537,7 @@ dummy_func(
             _CHECK_METHOD_VERSION_KW +
             _EXPAND_METHOD_KW +
             flush + // so that self is in the argument array
+            _CHECK_RECURSION_REMAINING +
             _PY_FRAME_KW +
             _SAVE_RETURN_OFFSET +
             _PUSH_FRAME;
@@ -5757,6 +5758,7 @@ dummy_func(
             _CHECK_PEP_523 +
             _MAKE_CALLARGS_A_TUPLE +
             _CHECK_IS_PY_CALLABLE_EX +
+            _CHECK_RECURSION_REMAINING +
             _PY_FRAME_EX +
             _SAVE_RETURN_OFFSET +
             _PUSH_FRAME;