Don't read null pointers, and fix a bug parsing function path conditions
Several small improvements:

* Plug a couple of missing cases in coercing null or undef pointers to/from scalars in a merge.
* Switch(scalar set): only set the reachable edges alive.
* Pointer comparison: inttoptr(scalar) != any allocated object.
* Support undef values in the extract-value-from-aggregate paths.
* Fix a missing pendingEdges decrement that prevented post-loop blocks from being marked certain.
Add support for allocation functions that yield constant-sized objects.