Expresions on RHS of binary operator after CallExpr ignored by CheckedRegionFinder

[john-h-kastner]

CheckedRegionFinder seems to stop early after encountering a CallExpr. This is a problem when an unsafe expression appears on the RHS of a binary operator with a CallExpr on the LHS.

Example:

int foo(void) { return 0; }
int *x = 1;
int bar() {
  return foo() + *x;
}

Converts to (-addcr):

int foo(void) _Checked { return 0; }
int *x = 1;
int bar() _Checked {
  return foo() + *x;
}

Dereferencing the unchecked pointer x should stop the function from being _Checked. Notably, this is the behavior we see if bar is instead defined with return *x + foo();