GeezerVison

cat -n crates/common/src/refcount.rs | head -80

# Search for MASK definition and inc_by usage
rg -n "MASK|inc_by" crates/common/src/refcount.rs

# Find all call sites of inc_by
rg -n "inc_by" --type rs

# Find all call sites of inc_by across the codebase
rg -n "inc_by\s*\(" --type-list | head -5

# Find all call sites of inc_by
rg -n "\.inc_by\s*\("

# Check the specific call site context
sed -n '840,850p' crates/vm/src/object/core.rs | cat -n

# Verify the math: what is MASK / MAX_REFCOUNT value
python3 << 'EOF'
import sys
max_refcount = (2**63 - 1) if sys.maxsize == (2**63 - 1) else (2**31 - 1)
print(f"isize::MAX on this system: {max_refcount}")
print(f"Self::MASK = {max_refcount}")

# Test the underflow scenario
n_large = max_refcount + 1000
mask = max_refcount
result = mask - n_large if n_large <= mask else (mask.bit_length(), "would underflow")
print(f"\nIf n = {n_large} (exceeds MASK):")
print(f"  Self::MASK - n underflows in release mode to: {(1 << 64) - (n_large - mask)}")
print(f"  The check would compare against this huge number and likely skip abort()")
EOF

# Check if there are any guards or validation of the n parameter elsewhere
rg -n "inc_by" -B 5 -A 5

 pub fn inc_by(&self, n: usize) {
+    if n > Self::MASK {
+        std::process::abort();
+    }
     let old_size = self.strong.fetch_add(n, Relaxed);
-
     if old_size & Self::MASK > Self::MASK - n {
         std::process::abort();
     }
 }

In `@crates/common/src/refcount.rs` around lines 39 - 44, The inc_by method must
validate its n argument before using it to detect overflow; add an explicit
bounds check at the top of pub fn inc_by(&self, n: usize) so that if n == 0 it
returns early and if n > Self::MASK it aborts (to avoid subtraction underflow
when computing Self::MASK - n). After that, keep the existing fetch_add/overflow
check (using self.strong.fetch_add) unchanged; this ensures the existing
overflow detection logic remains correct for valid n values (<= MASK).

-                zelf.0.ref_count.inc_by(2);
-                let after_inc = zelf.strong_count(); // Should be 2
+                zelf.0.ref_count.inc_by(2);
 
                 if let Err(e) = slot_del(zelf, vm) {
                     let del_method = zelf.get_class_attr(identifier!(vm, __del__)).unwrap();
                     vm.run_unraisable(e, None, del_method);
                 }
 
-                let after_del = zelf.strong_count();
-
-                // First decrement
-                zelf.0.ref_count.dec();
-
-                // Check for resurrection: if ref_count increased beyond our expected 2,
-                // then __del__ created new references (resurrection occurred).
-                if after_del > after_inc {
-                    // Resurrected - don't do second decrement, leave object alive
-                    return false;
-                }
-
-                // No resurrection - do second decrement to get back to 0
-                // This matches the double increment from inc()
-                zelf.0.ref_count.dec()
+                // Remove the two temporary refs added above. The second
+                // decrement returns true only if no refs remain.
+                zelf.0.ref_count.dec();
+                zelf.0.ref_count.dec()

In `@crates/vm/src/object/core.rs` around lines 843 - 867, The destructor path
increments temporary refs via zelf.0.ref_count.inc_by(2) then on a resurrection
only performs one decrement, leaking one temporary ref; change the logic so both
temporary decs always run (call zelf.0.ref_count.dec() twice) and use the
return/result of the second dec to determine whether references remain (i.e.,
whether to treat the object as still alive) instead of skipping the second dec
on resurrection; update the block around strong_count(), slot_del(zelf, vm), and
the two ref_count.dec() calls (and the resurrection check that currently uses
after_del > after_inc) so the second dec's result drives the decision.