[BugFix] Reject a constant rebound inside a nested region - #3353

Refs #2977.

Why

Builder.bind has a fast path for a constant right-hand side (an int, float, str or int32 IntImm) that returns the value directly and drops the name's binding record. Assigning a constant to a name that already has a live binding in an enclosing region therefore went through unremarked: the constant replaced the value at trace time, the enclosing if was dropped, and every later read saw the constant unconditionally.

for i in T.serial(4):
    val = A[i]
    if val < 10:
        val = 10
    if val > 100:
        val = 100
    Out[i] = val

With A = [5, 50, 150, 10] this returned [10, 10, 10, 10] instead of [10, 50, 100, 10].

The expression form of the same rebind is already rejected:

RuntimeError: Immutable variable `val` is used outside its defining region!

so the same illegal program was accepted or silently miscompiled depending only on the form of the right-hand side.

What changed

Two commits.

The constant fast path rejects that rebind with the same message, before it drops the record. The rejection is narrow in two ways:

• It needs the name to have a binding that is still live in an enclosing region. A rebind at the same level, and the first binding of a name, are untouched.
• A name whose binding is in a region that has already closed is left alone, so a constant stays reusable once the region that introduced it is gone. That is the behaviour the record-dropping was there for, and it is preserved.

Verification

• Four cases added to testing/python/language/test_tilelang_language_loop_target_binding.py, the module that already asserts this message for the loop-target and expired-local cases: the int and IntImm spellings of the conditional rebind, plus controls for a same-level rebind and for reuse after the region closed. The two rejection cases fail on an unmodified tree with DID NOT RAISE RuntimeError; both controls pass in both states.
• Blast radius, given that this is the eager frontend: 231 passed across the eager, frontend, loop-target-binding and augassign modules, and 730 passed, 42 skipped across testing/python/transform/, testing/python/quantize/ and testing/python/components/. The two deselected are pre-existing environment limits on dynamic shared memory size. No test in either group relies on the accepted rebind.

A second commit makes the two constant paths clear the name's record alike. Only the int/float/str path did; the int32 IntImm path returned the value and left the record behind, so a record from an earlier expression binding of the same name outlived its region, and the same constant read two ways behaved differently:

for i in T.serial(1):
    val = A[i]
    val = 7            # readable afterwards
    val = T.int32(7)   # RuntimeError: Immutable variable `val` is used
                       # outside its defining region!

The spelling case above covers both spellings, and it is the IntImm one that fails without the second commit.

Summary

• Builder.bind now rejects constant rebinds when the name has a live binding in an enclosing region. It raises the existing “outside its defining region” error.
• The IntImm fast path also clears stale binding-scope tracking. This allows reuse after the defining region closes.
• Added tests for Python integer and T.int32 rebinds, same-level rebinding, and constant reuse after a region closes.
• The author reports 231 targeted tests passed. The author also reports 730 tests passed and 42 skipped across the transform, quantize, and components suites. Two tests were deselected due to environment limits on dynamic shared memory.

Verified end to end, together with the other contributions from this batch: VERIFICATION.md