Fix use-after-free bug in mergeTwoFunctions(). (#173126)
This was caught by Apple's Probabilistic Guard Malloc which detected
that OldF's memory is freed inside mergeTwoFunctions(), and then
back in insert() the now dangling pointer is dereferenced again.
rdar://163874208
