[Bug][Relax][ONNX] BinaryBase.base_impl calls .item() on a TIR PrimExpr

[zacharywhitley]

Summary

BinaryBase.base_impl in the Relax ONNX frontend crashes when both
operands are PrimValues from shape arithmetic. The numpy fallback
returns a TIR PrimExpr, then .item() is called on it.

Environment

TVM 0.25.0.post1 (pip), macOS arm64, Python 3.11.

Reproducer

Model: owensong/Inflect-Nano-v2 on Hugging Face (Apache-2.0). The
original (un-simplified) encoder has a Sub on two shape-derived
PrimValues.

import onnx
from tvm.relax.frontend.onnx import from_onnx

model = onnx.load("encoder.onnx")  # do NOT run onnxsim
mod = from_onnx(model, keep_params_in_input=False)

Failure

AttributeError: 'Sub' object has no attribute 'item'

At python/tvm/relax/frontend/onnx/onnx_frontend.py:475-493.
_to_numpy wraps two PrimValues as 0-d object arrays; numpy dispatch
returns a bare PrimExpr (symbolic, not numeric); fall-through calls
.item() which the PrimExpr doesn't implement.

Suggested patch

Detect when the numpy op returned a PrimExpr and wrap it back into
a PrimValue rather than calling .item().

--- a/python/tvm/relax/frontend/onnx/onnx_frontend.py
+++ b/python/tvm/relax/frontend/onnx/onnx_frontend.py
@@ BinaryBase.base_impl
-        return output.item()
+        if isinstance(output, tvm.tir.PrimExpr):
+            return relax.PrimValue(output)
+        return output.item()

User workaround

onnxsim with concrete input shapes constant-folds most Shape → Gather → Sub patterns away. Works when input shapes can be pinned; not
viable for genuinely dynamic dimensions.

Discovered by

Compiling Inflect nano encoder from
cognition. See sibling
reports for related structural bugs in the same frontend (bug 3 in
particular has no user workaround).