[analyzer] Model correct dispatch_once() 'done' value in BodyFarm

The analyzer's BodyFarm models dispatch_once() by comparing the passed-in
predicate against a known 'done' value. If the predicate does not have that
value, the model updates the predicate to have that value and executes the
passed in block.

Unfortunately, the current model uses the wrong 'done' value: 1 instead of ~0.
This interferes with libdispatch's static inline function _dispatch_once(),
which enables a fast path if the block has already been executed. That function
uses __builtin_assume() to tell the compiler that the done flag is set to ~0 on
exit. When r302880 added modeling of __builtin_assume(), this caused the
analyzer to assume 1 == ~0. This in turn caused the analyzer to never explore any code after a call to dispatch_once().

This patch regains the missing coverage by updating BodyFarm to use the correct
'done' value.

rdar://problem/34413048

Differential Revision: https://reviews.llvm.org/D39691

llvm-svn: 317516