We should be special casing as few instructions as possible in the front-end.

This can probably be better handled in the optimizer, as we might want to leave a single _POP_TOP_OPARG rather than a long series of _POP_TOPs.

Ok done,

This is a bit strange. Does the code generator force you to do this?

Would this work?

    PyObject *res_o = _Py_BuiltinCallFast_StackRef(...)
    if (res_o == NULL) {
         ERROR_NO_POP();
    }
    s = self_or_null;
    DEAD(self_or_null);
    DEAD(args);
    res = PyStackRef_FromPyObjectSteal(res_o);
    PyStackRef_CLOSE(callable);

If I do that, the code generator shrinks the "real" stack to nothing, sets the stack pointer to before callable, and then calls the close.

This is incorrect, as we need the self_or_null and args to still be visible from the stack when closing callable, as on FT, the stack is a GC root.

What does the generated code look like for what input?
I'm trying to establish if the code generator is buggy or not.
I think the problem might be that you're renaming args to a so the code generator thinks it is a new array.
IIRC though, if you change callable to res it will complain if you leave args as a.
So this might need a code generator fix.

This works, by telling the code generator that the stack layout is unchanged.

        op(_CALL_BUILTIN_FAST_EXPERIMENT, (callable, self_or_null, args[oparg] -- callable, self_or_null, args[oparg])) {
            /* Builtin METH_FASTCALL functions, without keywords */
            int total_args = oparg;
            _PyStackRef *arguments = args;
            if (!PyStackRef_IsNull(self_or_null)) {
                arguments--;
                total_args++;
            }
            STAT_INC(CALL, hit);
            PyObject *res_o = _Py_BuiltinCallFast_StackRef(
                callable,
                arguments,
                total_args
            );
            if (res_o == NULL) {
                ERROR_NO_POP();
            }
            _PyStackRef temp = callable;
            callable = PyStackRef_FromPyObjectSteal(res_o);
            PyStackRef_CLOSE(temp);
        }

Can you file an issue for this code generator fault?

I applied your fix and I'm impressed it works. I think the code generator isn't faulty. I did mark the top two items as DEAD so it shrinking the stack is right.

Why 6?
Can you either derive this number or explain it in a comment?