The eval cost of an Expr should always be set in analyze(), even if the eval cost is unknown (-1).
The following sequence of events will make an Expr have an incorrect eval cost set:
1. analyze() Expr e which sets a valid eval cost
2. substitute a child of e with an expr that has an invalid eval cost
3. calling analyze() on e will leave the original valid eval cost, but it should be invalid after the substitution+analyze