The analyzer's BodyFarm models dispatch_once() by comparing the passed-in predicate against a known 'done' value. If the predicate does not have that value, the model updates the predicate to have that value and executes the passed in block.
Unfortunately, the current model uses the wrong 'done' value: 1 instead of ~0. This interferes with libdispatch's static inline function _dispatch_once(), which enables a fast path if the block has already been executed. That function uses builtin_assume() to tell the compiler that the done flag is set to ~0 on exit. When r302880 added modeling of builtin_assume(), this caused the analyzer to assume 1 == ~0, which in turn caused the analyzer to never explore any code after a call to dispatch_once().
This patch regains the missing coverage by updating BodyFarm to use the correct 'done' value.
rdar://problem/34413048