{"record":{"id":"c4b3d82e1ee4ed96","repo":"pydantic/monty","slug":"dereferenced-found-while-converting-to-montyobject","errorCode":null,"errorMessage":"Dereferenced found while converting to MontyObject","messagePattern":"Dereferenced found while converting to MontyObject","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/monty/src/object_bridge.rs","lineNumber":617,"sourceCode":"                            position: file.position(),\n                        })\n                    }\n                    HeapReadOutput::ExtFunction(function) => Self::Function {\n                        name: function.get(vm.heap).as_str().to_owned(),\n                        docstring: None,\n                    },\n                    _ => repr_or_error(object, vm),\n                };\n\n                // Remove from visited set after processing\n                visited.remove(id);\n                result\n            }\n            Value::Builtin(Builtins::Type(t)) => Self::Type(MontyType::from_internal(*t, vm)),\n            Value::Builtin(Builtins::ExcType(e)) => Self::Type(MontyType::Exception(*e)),\n            Value::Builtin(Builtins::Function(f)) => Self::BuiltinFunction(*f),\n            #[cfg(feature = \"memory-model-checks\")]\n            Value::Dereferenced => panic!(\"Dereferenced found while converting to MontyObject\"),\n            _ => repr_or_error(object, vm),\n        }\n    }\n}\n\n/// Crate-internal bridge between [`MontyType`] and the runtime [`Type`].\n///\n/// `MontyType` lives in `monty-types` (it is pure data), but mapping it to and\n/// from the runtime `Type` needs heap/intern access, so the conversions stay\n/// here as a `pub(crate)` extension trait.\npub(crate) trait MontyTypeExt: Sized {\n    fn to_internal(&self) -> Option<Type>;\n\n    fn from_internal_static(ty: Type) -> Self;\n\n    fn from_internal(ty: Type, vm: &mut VM<'_>) -> Self;\n}\n","sourceCodeStart":599,"sourceCodeEnd":635,"githubUrl":"https://github.com/pydantic/monty/blob/adc986b362e3961f407868cb118a99fe831b9e61/crates/monty/src/object_bridge.rs#L599-L635","documentation":"Same boundary rule as the Undefined case: Value::Dereferenced is a memory-model-checks-only sentinel for a released heap object and must never be converted into a MontyObject. The panic fires when a dereferenced value reaches the host-object conversion under the `memory-model-checks` feature.","triggerScenarios":"Running with `memory-model-checks` and converting a Value::Dereferenced via the bridge — a heap entry was freed/dereferenced but the Value was still alive at the conversion point, typically because a refcount drop path left a stale reference in a container or on the stack.","commonSituations":"Memory-model CI runs after changes to heap.rs, drop_with paths, or container cleanup; a leaked stale value is then returned to the host.","solutions":["Fix the path that kept the stale Value alive after its heap entry was dereferenced (guard with defer_drop!/DropGuard).","Ensure containers implement DropWithContext so their elements are released before the container crosses the bridge.","Re-run without the feature to confirm scope; then reproduce with `cargo test --features memory-model-checks` on the relevant test binary."],"exampleFix":"// before\nlet value = self.pop();\nheap.dec_ref(id); // value stale afterwards\nlet obj = MontyObject::from_value(value, vm)?;\n// after\nlet value = self.pop();\ndefer_drop!(value, heap); // released on every path before any conversion\n// build the MontyObject from a live value instead","handlingStrategy":"type-guard","validationCode":"// ensure the value is live before conversion\nif matches!(value, Value::Dereferenced) { return Err(BridgeError::stale_value()); }","typeGuard":"fn is_dereferenced(v: &Value) -> bool { matches!(v, Value::Dereferenced) }","tryCatchPattern":null,"preventionTips":["Use defer_drop!/DropGuard for every owned heap-backed value","Give containers DropWithContext impls so elements release together","Run `cargo test --features memory-model-checks` for the touched test binaries"],"tags":["rust","internal-invariant","memory-model"],"backgroundTag":"internal-invariant-violation","analyzedSha":"adc986b362e3961f407868cb118a99fe831b9e61","analyzedAt":"2026-09-13T19:19:18.698Z","contentChangedAt":"2026-09-13T19:19:18.698Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}