Freeze objects at value boundaries

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: anakrish

src/builtins/azure_policy/template_functions_collection.rs

@@ -10,7 +10,6 @@ use crate::builtins;
 use crate::lexer::Span;
 use crate::value::Object;
 use crate::value::Value;
-use crate::Rc;
 
 use alloc::vec::Vec;
 use anyhow::Result;
@@ -79,7 +78,7 @@ fn fn_intersection(
                 };
                 result.retain(|k, v| other.get(k).is_some_and(|ov| *ov == *v));
             }
-            Ok(Value::Object(Rc::new(result)))
+            Ok(result.into_value())
         }
         _ => Ok(Value::Undefined),
     }
@@ -130,7 +129,7 @@ fn fn_union(_span: &Span, _params: &[Ref<Expr>], args: &[Value], _strict: bool)
                     result.insert(k.clone(), merged);
                 }
             }
-            Ok(Value::Object(Rc::new(result)))
+            Ok(result.into_value())
         }
         _ => Ok(Value::Undefined),
     }
@@ -273,7 +272,7 @@ fn fn_create_object(
         }
     }
 
-    Ok(Value::Object(Rc::new(map)))
+    Ok(map.into_value())
 }
 
 // ── Helpers ───────────────────────────────────────────────────────────
@@ -290,7 +289,7 @@ fn merge_objects(base: &Object, overlay: &Object) -> Value {
         };
         result.insert(k.clone(), merged);
     }
-    Value::Object(Rc::new(result))
+    result.into_value()
 }
 
 fn extract_usize(v: &Value) -> Option<usize> {

src/builtins/azure_policy/template_functions_misc.rs

@@ -88,7 +88,7 @@ fn fn_items(_span: &Span, _params: &[Ref<Expr>], args: &[Value], _strict: bool)
         let mut entry = Object::new();
         entry.insert(Value::from("key"), k.clone());
         entry.insert(Value::from("value"), v.clone());
-        result.push(Value::Object(Rc::new(entry)));
+        result.push(entry.into_value());
     }
     Ok(Value::Array(Rc::new(result)))
 }

src/builtins/objects.rs

@@ -284,7 +284,9 @@ fn filter(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> R
         _ => bail!(span.error(format!("`{name}` requires array/object/set argument").as_str())),
     };
 
-    Ok(Value::Object(obj))
+    let mut value = Value::Object(obj);
+    value.freeze_recursive();
+    Ok(value)
 }
 
 fn get(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> Result<Value> {
@@ -334,7 +336,9 @@ fn remove(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> R
         _ => bail!(span.error(format!("`{name}` requires array/object/set argument").as_str())),
     };
 
-    Ok(Value::Object(obj))
+    let mut value = Value::Object(obj);
+    value.freeze_recursive();
+    Ok(value)
 }
 
 fn is_subset(sup: &Value, sub: &Value) -> bool {
@@ -391,7 +395,9 @@ fn object_union(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool
     let _ = ensure_object(name, &params[0], args[0].clone())?;
     let _ = ensure_object(name, &params[1], args[1].clone())?;
 
-    union(&args[0], &args[1])
+    let mut result = union(&args[0], &args[1])?;
+    result.freeze_recursive();
+    Ok(result)
 }
 
 fn object_union_n(
@@ -418,6 +424,7 @@ fn object_union_n(
         u = union(&u, a)?;
     }
 
+    u.freeze_recursive();
     Ok(u)
 }
 

src/engine.rs

@@ -397,7 +397,8 @@ impl Engine {
     /// # Ok(())
     /// # }
     /// ```
-    pub fn set_input(&mut self, input: Value) {
+    pub fn set_input(&mut self, mut input: Value) {
+        input.freeze_recursive();
         self.interpreter.set_input(input);
     }
 
@@ -465,7 +466,9 @@ impl Engine {
             bail!("data must be object");
         }
         self.prepared = false;
-        self.interpreter.get_init_data_mut().merge(data)
+        self.interpreter.get_init_data_mut().merge(data)?;
+        self.interpreter.get_init_data_mut().freeze_recursive();
+        Ok(())
     }
 
     /// Get the data document.

src/interpreter.rs

@@ -2343,7 +2343,10 @@ impl Interpreter {
         self.eval_query(query)?;
 
         match self.contexts.pop() {
-            Some(ctx) => Ok(ctx.value),
+            Some(mut ctx) => {
+                ctx.value.freeze_recursive();
+                Ok(ctx.value)
+            }
             None => bail!("internal error: context already popped"),
         }
     }
@@ -3337,7 +3340,11 @@ impl Interpreter {
 
         Ok(match result {
             true => match &popped_ctx.value {
-                Value::Object(_) => popped_ctx.value,
+                Value::Object(_) => {
+                    let mut value = popped_ctx.value;
+                    value.freeze_recursive();
+                    value
+                }
                 Value::Array(a) if a.len() == 1 => a
                     .first()
                     .cloned()

src/rvm/program/serialization/value.rs

@@ -266,7 +266,7 @@ impl<'de> Visitor<'de> for BinaryValueVisitor {
                 for (key, value) in entries {
                     map.insert(key.into_value(), value.into_value());
                 }
-                Ok(BinaryValue(Value::Object(crate::Rc::new(map))))
+                Ok(BinaryValue(map.into_value()))
             }
             (BinaryVariant::Undefined, variant) => {
                 variant.unit_variant()?;

src/rvm/vm/comprehension.rs

@@ -4,7 +4,6 @@
 use crate::rvm::instructions::{ComprehensionBeginParams, ComprehensionMode};
 use crate::value::Object;
 use crate::value::Value;
-use crate::Rc;
 use alloc::format;
 use alloc::sync::Arc;
 use alloc::vec::Vec;
@@ -34,7 +33,7 @@ impl RegoVM {
         let initial_result = match params.mode {
             ComprehensionMode::Set => Value::new_set(),
             ComprehensionMode::Array => Value::new_array(),
-            ComprehensionMode::Object => Value::Object(Rc::new(Object::new())),
+            ComprehensionMode::Object => Object::new().into_value(),
         };
         self.set_register(params.result_reg, initial_result.clone())?;
 
@@ -121,7 +120,7 @@ impl RegoVM {
         let initial_result = match params.mode {
             ComprehensionMode::Set => Value::new_set(),
             ComprehensionMode::Array => Value::new_array(),
-            ComprehensionMode::Object => Value::Object(Rc::new(Object::new())),
+            ComprehensionMode::Object => Object::new().into_value(),
         };
         self.set_register(params.result_reg, initial_result.clone())?;
 
@@ -589,15 +588,17 @@ impl RegoVM {
         // `ComprehensionEnd` is reached from a loaded program; an empty stack
         // here means malformed user-supplied bytecode, which must still surface
         // as a typed error rather than a panic — including in debug builds.
-        self.comprehension_stack.pop().map_or_else(
-            || {
-                Err(VmError::InvalidIteration {
-                    value: Value::String(Arc::from("No active comprehension context")),
-                    pc: self.pc,
-                })
-            },
-            |_context| Ok(()),
-        )
+        let context = self
+            .comprehension_stack
+            .pop()
+            .ok_or_else(|| VmError::InvalidIteration {
+                value: Value::String(Arc::from("No active comprehension context")),
+                pc: self.pc,
+            })?;
+        let mut value = self.take_register(context.result_reg)?;
+        value.freeze_recursive();
+        self.set_register(context.result_reg, value)?;
+        Ok(())
     }
 
     fn execute_comprehension_end_suspendable(&mut self) -> Result<()> {
@@ -628,6 +629,9 @@ impl RegoVM {
                     return_pc: _,
                     context,
                 } => {
+                    let mut value = self.take_register(context.result_reg)?;
+                    value.freeze_recursive();
+                    self.set_register(context.result_reg, value)?;
                     let raw_target = context.resume_pc;
                     let resume_pc = if raw_target <= self.pc {
                         self.pc.saturating_add(1)

src/value/object/serde.rs

@@ -48,7 +48,7 @@ impl<'de> Visitor<'de> for ObjectVisitor {
             crate::utils::limits::check_memory_limit_if_needed()
                 .map_err(|err| A::Error::custom(err.to_string()))?;
         }
-        Ok(obj)
+        Ok(obj.freeze())
     }
 }