Add klee_xyj() to debug.
Support -target-function: pointerArg with symbolic content

TODO: symbolic integer\struct\...