Actually this situation will crash with the current bindings:
module = builtin.ModuleOp.parse("""
module {
arith.constant 10
}
""")
const_op = module.body.operations[0]
print(const_op)
PassManager.parse('builtin.module(canonicalize)').run(module)
print(const_op) # Segmentation fault (core dumped)
And I don’t think we have the tools to prevent this today, we would need something like the IR listeners proposal to properly track invalidated references. And even then, this wouldn’t really work in the opposite direction (C++ references invalidated by outside code) since C++ holds raw pointers rather than handles that can be invalidated.