internal/core/adt: fix panic on reinserted pattern constraint conjunct

When insertConstraint finds that a conjunct was already added to a
pattern constraint, it records a defID replacement. The existing
conjunct may have been inserted under a previous OpContext, for
instance when "cue eval -e" evaluates an expression against an
already evaluated instance whose pattern constraints it re-triggers.
Its defID then indexes the previous context's containments table and
may be out of range for the current one, panicking in addReplacement.

Skip the replacement unless both conjuncts got their defIDs from the
current context, matching the other opID misalignment guards.

Fixes #4449

Assisted-by: Claude Code (claude-fable-5)
Signed-off-by: Daniel Martí <mvdan@mvdan.cc>
Change-Id: I15b8775d0f56a85070a36183d3104a54517275d0
Reviewed-on: https://cue.gerrithub.io/c/cue-lang/cue/+/1244341
Reviewed-by: Marcel van Lohuizen <mpvl@gmail.com>
TryBot-Result: CUEcueckoo <cueckoo@cuelang.org>
Unity-Result: CUE porcuepine <cue.porcuepine@gmail.com>

Author: mvdan

cmd/cue/cmd/testdata/script/eval_issue4449.txtar

@@ -0,0 +1,29 @@
+# Verify that eval of an expression does not panic when it re-inserts a
+# pattern constraint conjunct that was first inserted while evaluating the
+# instance under a different OpContext.
+# Issue #4449.
+
+exec cue eval -e export.objects.p in.cue
+cmp stdout stdout.golden
+
+-- in.cue --
+export: objects: ({
+	in: _
+	out: p: {
+		for x in in.deployment {}
+	}
+} & {in: export.objects}).out
+export: objects: [string]: _
+-- stdout.golden --
+_ &
+    {
+        for x in OBJECTS.deployment {}
+    }
+
+//cue:path: export.objects
+let OBJECTS = ({
+    in: _
+    out: p: {
+        for x in OBJECTS.deployment {}
+    }
+} & {in: OBJECTS}).out & {{[string]: _}}

internal/core/adt/constraints.go

@@ -100,7 +100,10 @@ func (n *nodeContext) insertConstraint(pattern Value, c Conjunct) bool {
 	} else {
 		for x := range constraint.LeafConjuncts() {
 			if x.x == c.x && x.Env.Equal(ctx, c.Env) {
-				if c.CloseInfo.opID == n.ctx.opID {
+				// Both defIDs must stem from the current OpContext: x may
+				// predate it, in which case its defID indexes another
+				// context's containments table.
+				if c.CloseInfo.opID == n.ctx.opID && x.CloseInfo.opID == n.ctx.opID {
 					// TODO: do we need this replacement?
 					src := x.CloseInfo.defID
 					dst := c.CloseInfo.defID