Fix a number of bugs in __val_expr's subset operator[].

The current definitions were entirely broken. They didn't call any
existing constructor and the forgot to friend the expression types they
were trying to construct.

llvm-svn: 357453