Fix list contains reflected __eq__, update bugs.md

list_contains now tries the search value's __eq__ when the element's
__eq__ returns NotImplemented. This makes ALWAYS_EQ/NEVER_EQ sentinel
comparison patterns work correctly for list `in` operator.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jgarzik

bugs.md

@@ -101,6 +101,16 @@
 **Root cause**: `dict_keys_equal` returned "not equal" for any non-string, non-numeric heap pointers. Tuple keys, frozenset keys, etc. all failed equality checks.
 **Fix**: Add `.dke_try_richcompare` fallback that calls `tp_richcompare(PY_EQ)` + `obj_is_true` for non-string heap pointer keys.
 
+### 21. assertRaises double-free on fn(*args) exception (opcodes_call.asm)
+**Symptom**: `assertRaises(ValueError, bad)` crashes with double-free
+**Root cause**: CALL_FUNCTION_EX freed cfex_temp_pending, then eval_exception_unwind freed it again
+**Fix**: Clear cfex_temp_pending before the call, not after
+
+### 22. list `in` operator doesn't call reflected __eq__ (list.asm)
+**Symptom**: `ALWAYS_EQ in [1]` returns False
+**Root cause**: list_contains only tried element's __eq__, not value's reflected __eq__
+**Fix**: Added `.try_reflected` path in list_contains
+
 ### Known Bugs Not Yet Fixed
 - `dict.update(x=1, y=2)` with kwargs segfaults (methods.asm)
 - `repr(d.keys())` returns wrong value (dict view repr not implemented)

src/pyo/list.asm

@@ -1162,6 +1162,65 @@ DEF_FUNC list_contains, LC_FRAME
     call rax
     ; Check for NotImplemented (NULL return = tag 0)
     test edx, edx
+    jnz .elem_check_result
+    ; Element's __eq__ returned NotImplemented — try reflected (value.__eq__(elem))
+    jmp .try_reflected
+
+.try_reflected:
+    ; Try the VALUE's __eq__ (reflected comparison: value.__eq__(elem))
+    mov rdi, [rbp - LC_VPAY]      ; value payload
+    mov r8d, [rbp - LC_VTAG]      ; value tag
+    ; Resolve value type
+    cmp r8d, TAG_PTR
+    jne .try_reflected_nonptr
+    mov rax, [rdi + PyObject.ob_type]
+    jmp .try_reflected_have_type
+.try_reflected_nonptr:
+    cmp r8d, TAG_SMALLINT
+    jne .next
+    lea rax, [rel int_type]
+.try_reflected_have_type:
+    mov rax, [rax + PyTypeObject.tp_richcompare]
+    test rax, rax
+    jnz .try_reflected_richcmp
+    ; No tp_richcompare — try dunder on heaptype
+    mov rax, [rdi + PyObject.ob_type]
+    mov rdx, [rax + PyTypeObject.tp_flags]
+    test rdx, TYPE_FLAG_HEAPTYPE
+    jz .next
+    ; Reload elem payload + tag for the reflected call
+    mov rax, [rbp - LC_IDX]
+    mov rbx, [rbp - LC_LIST]
+    mov rbx, [rbx + PyListObject.ob_item]
+    mov rdx, [rbp - LC_LIST]
+    mov rdx, [rdx + PyListObject.ob_item_tags]
+    mov rsi, [rbx + rax * 8]        ; elem payload
+    movzx ecx, byte [rdx + rax]     ; elem tag
+    ; dunder_call_2(self=value, other=elem, "__eq__", other_tag=elem_tag)
+    ; rdi = value (already set)
+    CSTRING rdx, "__eq__"
+    call dunder_call_2
+    test edx, edx
+    jz .next
+    jmp .elem_check_result
+.try_reflected_richcmp:
+    ; Reload elem for reflected call
+    push rax                         ; save richcompare func
+    mov rcx, [rbp - LC_IDX]
+    mov rbx, [rbp - LC_LIST]
+    mov rbx, [rbx + PyListObject.ob_item]
+    mov rdx, [rbp - LC_LIST]
+    mov rdx, [rdx + PyListObject.ob_item_tags]
+    mov rsi, [rbx + rcx * 8]        ; elem payload
+    movzx r12d, byte [rdx + rcx]    ; elem tag
+    pop rax
+    ; tp_richcompare(value, elem, PY_EQ, value_tag, elem_tag)
+    ; rdi = value (already set)
+    mov edx, PY_EQ
+    mov rcx, [rbp - LC_VTAG]        ; self_tag = value_tag
+    mov r8, r12                      ; other_tag = elem_tag
+    call rax
+    test edx, edx
     jz .next
 
 .elem_check_result: