RecursiveASTVisitor: Traverse the child of a BoundsValueExpr

[secure-sw-dev-bot]

This issue was copied from microsoft/checkedc-clang#978

---

Fixes #974
Fixes #977

This PR modifies RecursiveASTVisitor to traverse the child (E->getTemporaryBinding) of a BoundsValueExpr by default. This allows the CollectVarSetHelper in SemaBounds.cpp to determine the correct set of variables involved in expressions that contain a BoundsValueExpr. For example, in the expression BoundsValue(TempBinding(x)) + y, CollectVarSetHelper will return the set { x, y } rather than { y }.

Two other classes in SemaBounds.cpp that use RecursiveASTVisitor now override this behavior so that they do not traverse the temporary binding of a BoundsValueExpr:

• NonModifyingExprSema: expressions within bounds values should not be considered modifying.
• VariableCountHelper: variables within bounds values should not contribute to the variable occurrence count within an expression. The ReplaceVariable method ReplaceVariable(E, V, OriginalValue) returns the original expression E if VariableCountHelper returns 0 as the variable occurrence count of V in E. If V occurs within a BoundsValueExpr within E, then ReplaceVariable should return E without traversing it. Therefore, for an expression such as BoundsValue(TempBinding(x)), VariableCountHelper should return 0 as the occurrence count of x.

Testing:

• Added test cases to clang/test/CheckedC/static-checking/free-variables.c that involve expressions containing bounds values. These test cases cover the example in Wrong error from #903 when passing _Assume_bounds_cast directly to function with itype #974.