I was under the impression that this was guarded against. Specifically, that the invalidation mechanism (https://github.com/llvm/llvm-project/blob/582e1d58bd43af138033b98b736d97cc89c7b228/mlir/lib/Bindings/Python/IRModule.h#L668) is expected to mark as invalid any operations nested under the pass manager root. Maybe that was only discussed and never implemented, but it looks trivial to add. Certainly this will not update the pointers, but will at least give a proper exception in Python instead of segfaulting.