Implement the tentative loads pass, which determines those load instructions and memcpy operations that need a runtime check because they optimistically assume no side-effects from a locking operation.

Also to obtain acceptable results from it, implement simple escape analysis: objects are unescaped at a program point if their pointers haven't been stored and haven't been reduced to Unknown by a PHI or return node join (or in a manner we don't understand, by being operands to instructions that led to Overdef).

The escaped-if-stored behaviour could be improved: you're only really escaped if a block merge or maybe-store leads to Overdef, but this is more complexity than we need right now.

Unescaped objects are then immune to effects caused by operating on Overdef pointers: they aren't clobbered, marked reachable-from-old or marked thread-global when all other objects are.