youknowone · Nov 6, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 4, 2026
diff --git a/crates/stdlib/src/bisect.rs b/crates/stdlib/src/bisect.rs
@@ -3,144 +3,252 @@ pub(crate) use _bisect::module_def;
 #[pymodule]
 mod _bisect {
     use crate::vm::{
-        PyObjectRef, PyResult, VirtualMachine, function::ArgIndex, types::PyComparisonOp,
+        AsObject, PyObject, PyObjectRef, PyResult, TryFromBorrowedObject, VirtualMachine,
+        function::{ArgIndex, Either, OptionalArg, PyComparisonValue},
+        protocol::PySequence,
+        types::PyComparisonOp,
     };
 
     #[derive(FromArgs)]
     struct BisectArgs {
         a: PyObjectRef,
         x: PyObjectRef,
-        #[pyarg(any, default = 0)]
-        lo: ArgIndex,
+        #[pyarg(any, optional, py_default = "0")]
+        lo: OptionalArg<PyObjectRef>,
         // None means the sequence length.
         #[pyarg(any, optional)]
-        hi: Option<ArgIndex>,
+        hi: Option<PyObjectRef>,
         #[pyarg(named, optional)]
         key: Option<PyObjectRef>,
     }
 
-    // Handles objects that implement __index__ and makes sure index fits in needed isize.
-    #[inline]
-    fn handle_default(arg: ArgIndex, vm: &VirtualMachine) -> PyResult<isize> {
-        arg.into_int_ref().try_to_primitive(vm)
-    }
-
-    // Handles defaults for lo, hi.
-    //
-    //  - lo must be >= 0 with a default of 0.
-    //  - hi, while it could be negative, defaults to `0` and the same effect is achieved
-    //    (while loop isn't entered); this way we keep it a usize (and, if my understanding
-    //    is correct, issue 13496 is handled). Its default value is set to the length of the
-    //    input sequence.
-    #[inline]
-    fn as_usize(
-        lo: ArgIndex,
-        hi: Option<ArgIndex>,
-        seq_len: usize,
+    // Bind all arguments before calling __index__, then convert in the same
+    // order as the CPython wrapper. Keep the original argument objects alive.
+    fn parse_bounds(
+        lo: &OptionalArg<PyObjectRef>,
+        hi: Option<&PyObjectRef>,
         vm: &VirtualMachine,
-    ) -> PyResult<(usize, usize)> {
-        // We only deal with positives for lo, try_from can't fail.
-        let lo = usize::try_from(handle_default(lo, vm)?)
-            .map_err(|_| vm.new_value_error("lo must be non-negative"))?;
+    ) -> PyResult<(usize, isize)> {
+        let lo = match lo {
+            OptionalArg::Missing => 0,
+            OptionalArg::Present(obj) => {
+                let index = ArgIndex::try_from_borrowed_object(vm, obj)?;
+                isize::try_from(index.as_ref().as_bigint()).map_err(|_| {
+                    vm.new_overflow_error("Python int too large to convert to C ssize_t")
+                })?
+            }
+        };
+        let lo = usize::try_from(lo).map_err(|_| vm.new_value_error("lo cannot be negative"))?;
         let hi = match hi {
-            Some(value) => {
-                let value: isize = value.into_int_ref().try_to_primitive(vm)?;
-                usize::try_from(value).unwrap_or(0)
+            Some(obj) => {
+                if !obj.number().is_index() {
+                    let name = obj.class().slot_name();
+                    let end = name.floor_char_boundary(name.len().min(200));
+                    return Err(vm.new_type_error(format!(
+                        "argument should be integer or None, not '{}'",
+                        &name[..end]
+                    )));
+                }
+                let index = ArgIndex::try_from_borrowed_object(vm, obj)?;
+                isize::try_from(index.as_ref().as_bigint()).map_err(|_| {
+                    let name = obj.class().slot_name();
+                    let end = name.floor_char_boundary(name.len().min(200));
+                    vm.new_overflow_error(format!(
+                        "cannot fit '{}' into an index-sized integer",
+                        &name[..end]
+                    ))
+                })?
             }
-            None => seq_len,
+            None => -1,
         };
         Ok((lo, hi))
     }
 
+    // The -1 sentinel is shared by an omitted/None hi and an explicit -1.
+    // Other negative upper bounds have the same result as zero because lo is
+    // nonnegative. Only the sentinel requires asking the sequence for length.
     #[inline]
-    #[pyfunction]
-    fn bisect_left(
-        BisectArgs { a, x, lo, hi, key }: BisectArgs,
+    fn resolve_hi(hi: isize, sequence: PySequence<'_>, vm: &VirtualMachine) -> PyResult<usize> {
+        if hi == -1 {
+            sequence.length(vm)
+        } else {
+            Ok(usize::try_from(hi).unwrap_or(0))
+        }
+    }
+
+    type SequenceItem = for<'a> fn(PySequence<'a>, isize, &VirtualMachine) -> PyResult;
+
+    // Snapshot the item slot even when the search range is empty, as CPython does.
+    fn sequence_item(sequence: PySequence<'_>, vm: &VirtualMachine) -> PyResult<SequenceItem> {
+        sequence.slots().item.load().ok_or_else(|| {
+            let msg = {
+                let name = sequence.obj.class().slot_name();
+                let end = name.floor_char_boundary(name.len().min(200));
+                let name = &name[..end];
+                if sequence.obj.mapping_unchecked().check() {
+                    format!("{name} is not a sequence")
+                } else {
+                    format!("'{name}' object does not support indexing")
+                }
+            };
+            vm.new_type_error(msg)
+        })
+    }
+
+    #[inline]
+    fn bisect_impl<const LEFT: bool>(
+        a: &PyObject,
+        x: &PyObject,
+        mut lo: usize,
+        hi: isize,
+        key: Option<&PyObjectRef>,
         vm: &VirtualMachine,
     ) -> PyResult<usize> {
-        let (mut lo, mut hi) = as_usize(lo, hi, a.length(vm)?, vm)?;
+        let sequence = a.sequence_unchecked();
+        let mut hi = resolve_hi(hi, sequence, vm)?;
+        let get_item = sequence_item(sequence, vm)?;
+        // On failure, leave the recursion section before releasing the current
+        // item. This owner must be declared before the guard for drop ordering.
+        let mut error_item = None;
+        let recursion_context = if LEFT {
+            " in _bisect.bisect_left"
+        } else {
+            " in _bisect.bisect_right"
+        };
+        vm.enter_recursive_call(recursion_context)?;
+        let recursion_guard = scopeguard::guard((), |()| vm.leave_recursive_call());
+        // Snapshot identity and slot without keeping the original class alive:
+        // a callback can change x.__class__ and collect the old heap type.
+        let (needle_type_id, mut compare) = {
+            let class = x.class();
+            (class.get_id(), class.slots().richcompare.load())
+        };
 
-        while lo < hi {
+        let result = loop {
+            if lo >= hi {
+                break Ok(lo);
+            }
             // Handles issue 13496.
             let mid = (lo + hi) / 2;
-            let a_mid = a.get_item(&mid, vm)?;
-            let comp = if let Some(ref key) = key {
-                key.call((a_mid,), vm)?
+            let a_mid = get_item(sequence, mid as isize, vm)?;
+            let comp = if let Some(key) = key {
+                // The callback may delete its argument. Release our reference
+                // only after it returns, including when it raises an exception.
+                let result = match key.call((&*a_mid,), vm) {
+                    Ok(result) => result,
+                    Err(err) => {
+                        error_item = Some(a_mid);
+                        break Err(err);
+                    }
+                };
+                drop(a_mid);
+                result
             } else {
                 a_mid
             };
-            if comp.rich_compare_bool(&x, PyComparisonOp::Lt, vm)? {
+            let (left, right) = if LEFT { (&*comp, x) } else { (x, &*comp) };
+            let less = (|| {
+                if let Some(compare_fn) =
+                    compare.filter(|_| comp.class().get_id() == needle_type_id)
+                {
+                    match compare_fn(left, right, PyComparisonOp::Lt, vm)? {
-                if let Some(compare_fn) =
-                    compare.filter(|_| comp.class().get_id() == needle_type_id)
-                {
-                    match compare_fn(left, right, PyComparisonOp::Lt, vm)? {
+                if let Some(compare_fn) =
+                    compare.filter(|_| {
+                        comp.class().get_id() == needle_type_id
+                            && x.class().get_id() == needle_type_id
+                    })
+                {
+                    match compare_fn(left, right, PyComparisonOp::Lt, vm)? {
-                if let Some(compare_fn) =
-                    compare.filter(|_| comp.class().get_id() == needle_type_id)
-                {
-                    match compare_fn(left, right, PyComparisonOp::Lt, vm)? {
+                if let Some(compare_fn) =
+                    compare.filter(|_| {
+                        comp.class().get_id() == needle_type_id
+                            && x.class().get_id() == needle_type_id
+                    })
+                {
+                    match compare_fn(left, right, PyComparisonOp::Lt, vm)? {
+                        Either::A(obj) if obj.is(&vm.ctx.not_implemented) => {}
+                        Either::A(obj) => return obj.try_to_bool(vm),
+                        Either::B(PyComparisonValue::Implemented(value)) => return Ok(value),
+                        Either::B(PyComparisonValue::NotImplemented) => {}
+                    }
+                    // NotImplemented disables the shortcut for this search.
+                    // Generic dispatch retries __lt__ before reflected __gt__.
+                    compare = None;
+                }
+                // A different type does not disable the same-type shortcut
+                // for subsequent midpoint objects.
+                left.rich_compare_bool(right, PyComparisonOp::Lt, vm)
+            })();
+            let less = match less {
+                Ok(value) => value,
+                Err(err) => {
+                    error_item = Some(comp);
+                    break Err(err);
+                }
+            };
+            // Comparison results have already been released after conversion
+            // to bool. Dispose of the midpoint before starting another probe.
+            drop(comp);
+            if less == LEFT {
                 lo = mid + 1;
             } else {
                 hi = mid;
             }
-        }
-        Ok(lo)
+        };
+        drop(recursion_guard);
+        drop(error_item);
+        result
     }
 
     #[inline]
     #[pyfunction]
-    fn bisect_right(
+    fn bisect_left(
         BisectArgs { a, x, lo, hi, key }: BisectArgs,
         vm: &VirtualMachine,
     ) -> PyResult<usize> {
-        let (mut lo, mut hi) = as_usize(lo, hi, a.length(vm)?, vm)?;
+        let (low, high) = parse_bounds(&lo, hi.as_ref(), vm)?;
+        bisect_impl::<true>(&a, &x, low, high, key.as_ref(), vm)
+    }
 
-        while lo < hi {
-            // Handles issue 13496.
-            let mid = (lo + hi) / 2;
-            let a_mid = a.get_item(&mid, vm)?;
-            let comp = if let Some(ref key) = key {
-                key.call((a_mid,), vm)?
-            } else {
-                a_mid
-            };
-            if x.rich_compare_bool(&comp, PyComparisonOp::Lt, vm)? {
-                hi = mid;
-            } else {
-                lo = mid + 1;
-            }
-        }
-        Ok(lo)
+    #[inline]
+    #[pyfunction]
+    fn bisect_right(
+        BisectArgs { a, x, lo, hi, key }: BisectArgs,
+        vm: &VirtualMachine,
+    ) -> PyResult<usize> {
+        let (low, high) = parse_bounds(&lo, hi.as_ref(), vm)?;
+        bisect_impl::<false>(&a, &x, low, high, key.as_ref(), vm)
     }
 
     #[pyfunction]
     fn insort_left(BisectArgs { a, x, lo, hi, key }: BisectArgs, vm: &VirtualMachine) -> PyResult {
+        let (low, high) = parse_bounds(&lo, hi.as_ref(), vm)?;
         // The search runs on the key, the insert has to put back the item itself.
-        let needle = match key {
-            Some(ref key) => key.call((x.clone(),), vm)?,
-            None => x.clone(),
+        let needle = match &key {
+            Some(key) => Some(key.call((&*x,), vm)?),
+            None => None,
         };
-        let index = bisect_left(
-            BisectArgs {
-                a: a.clone(),
-                x: needle,
-                lo,
-                hi,
-                key,
-            },
+        let index = bisect_impl::<true>(
+            &a,
+            needle.as_deref().unwrap_or(&x),
+            low,
+            high,
+            key.as_ref(),
             vm,
-        )?;
-        vm.call_method(&a, "insert", (index, x))
+        );
+        drop(needle);
+        let index = index?;
+        let result = vm.call_method(&a, "insert", (index, &*x))?;
+        drop(result);
+        Ok(vm.ctx.none())
     }
 
     #[pyfunction]
     fn insort_right(BisectArgs { a, x, lo, hi, key }: BisectArgs, vm: &VirtualMachine) -> PyResult {
+        let (low, high) = parse_bounds(&lo, hi.as_ref(), vm)?;
         // The search runs on the key, the insert has to put back the item itself.
-        let needle = match key {
-            Some(ref key) => key.call((x.clone(),), vm)?,
-            None => x.clone(),
+        let needle = match &key {
+            Some(key) => Some(key.call((&*x,), vm)?),
+            None => None,
         };
-        let index = bisect_right(
-            BisectArgs {
-                a: a.clone(),
-                x: needle,
-                lo,
-                hi,
-                key,
-            },
+        let index = bisect_impl::<false>(
+            &a,
+            needle.as_deref().unwrap_or(&x),
+            low,
+            high,
+            key.as_ref(),
             vm,
-        )?;
-        vm.call_method(&a, "insert", (index, x))
+        );
+        drop(needle);
+        let index = index?;
+        let result = vm.call_method(&a, "insert", (index, &*x))?;
+        drop(result);
+        Ok(vm.ctx.none())
     }
 }
diff --git a/crates/vm/src/function/number.rs b/crates/vm/src/function/number.rs
@@ -1,6 +1,7 @@
 use super::argument::OptionalArg;
 use crate::{
-    AsObject, Py, PyObject, PyObjectRef, PyResult, TryFromObject, VirtualMachine,
+    AsObject, Py, PyObject, PyObjectRef, PyResult, TryFromBorrowedObject, TryFromObject,
+    VirtualMachine,
     builtins::{PyComplex, PyFloat, PyInt, PyIntRef},
 };
 use core::{ffi::c_int, ops::Deref};
@@ -202,8 +203,8 @@ impl From<ArgIndex> for PyIntRef {
     }
 }
 
-impl TryFromObject for ArgIndex {
-    fn try_from_object(vm: &VirtualMachine, obj: PyObjectRef) -> PyResult<Self> {
+impl<'a> TryFromBorrowedObject<'a> for ArgIndex {
+    fn try_from_borrowed_object(vm: &VirtualMachine, obj: &'a PyObject) -> PyResult<Self> {
         Ok(Self {
             value: obj.try_index(vm)?,
         })